joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408b92
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x818
mov eax, dword [0x42b7a4]
xor eax, esp
mov dword [esp + 0x814], eax
mov ecx, dword [esp + 0x824]
lea edx, [esp + 0x14]
mov eax, dword [esp + 0x820]
push ebx
mov ebx, dword [esp + 0x830]
push ebp
push esi
mov esi, dword [esp + 0x828]
push edi
mov edi, dword [esp + 0x838]
push 0x400
push edx
push ecx
push eax
push esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
call fcn.00408704
test al, al
jne 0x408c9a
mov ebp, dword [esp + 0x840]
push ebp
push ebx
push edi
call fcn.00407851
cmp byte [0x42b261], 0
sete al
test al, al
jne 0x408cb8
push dword [esp + 0x10]
push esi
call fcn.00408e06
mov edx, eax
xor eax, eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x14], eax
test edx, edx
je 0x408c8c
lea ecx, [ebp*2]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
push edi
lea ecx, [esp + 0x28]
push ecx
push eax
push dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 0x1c]
mov esi, eax
test esi, esi
sete cl
mov byte [esp + 0x18], cl
call fcn.00407f48
test esi, esi
jne 0x408c84
mov eax, dword [esp + 0x10]
shr eax, 1
test ebp, ebp
jne 0x408c75
xor eax, eax
mov word [edi], ax
jmp 0x408c84
lea ecx, [ebp - 1]
cmp eax, ecx
jb 0x408c7e
mov eax, ecx
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [esp + 0x14]
test al, al
jne 0x408cba
push ebp
push ebx
push edi
call fcn.00407851
mov eax, dword [esp + 0x14]
jmp 0x408cba
lea eax, [esp + 0x24]
push eax
call fcn.00408417
test eax, eax
je 0x408caa
mov ebx, eax
push dword [esp + 0x840]
push ebx
push edi
call fcn.00407851
mov al, 1
mov ecx, dword [esp + 0x824]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a986
add esp, 0x818
ret 0x18

Function at 0x408e8b
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x42b7a4]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov ebx, dword [esp + 0x814]
lea eax, [esp + 8]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
mov esi, dword [esp + 0x824]
push edi
mov edi, dword [esp + 0x81c]
push 0x400
push eax
push ebp
push ebx
push edi
call fcn.00408704
test al, al
jne 0x408f22
cmp byte [0x42b261], al
sete al
test al, al
jne 0x408f2f
lea eax, [esp + 0x10]
push eax
push ebx
push edi
call fcn.004087d6
mov edi, eax
test edi, edi
je 0x408f1a
push esi
call fcn.0040e348
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call fcn.00407f48
jmp 0x408f1e
mov esi, dword [esp + 0x10]
mov eax, esi
jmp 0x408f31
push 1
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.00407f9d
xor eax, eax
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a986
add esp, 0x808
ret 0x10
Function at 0x4091ea
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x422c08
push 1
push ebx
push 0x422c28
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40931f
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push esi
push ecx
push 0x422c18
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0x420294]
call dword [esi]
test eax, eax
js 0x40930b
cmp byte [ebp + 8], bl
je 0x409250
mov eax, dword [ebp - 8]
push 2
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x420294]
call esi
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x420294]
call esi
cmp dword [ebp + 0x18], ebx
je 0x409281
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x420294]
call esi
mov eax, dword [ebp - 4]
push ebx
mov ecx, dword [eax]
mov esi, dword [ecx + 0x44]
mov ecx, esi
cmp dword [ebp + 0x1c], ebx
jne 0x409298
push 0x4204c0
jmp 0x40929b
push dword [ebp + 0x1c]
push eax
call dword [0x420294]
call esi
cmp dword [ebp + 0x20], ebx
je 0x4092bf
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x2c]
mov ecx, esi
call dword [0x420294]
call esi
cmp dword [ebp + 0x14], ebx
je 0x4092da
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x420294]
call esi
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x420294]
call esi
test eax, eax
js 0x4092f8
mov bl, 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x420294]
call esi
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x420294]
call esi
pop esi
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x409347
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
setne al
ret 8
Function at 0x40a525
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
push dword [esp + 0x10]
call fcn.0040e348
lea edi, [eax + 1]
lea ecx, [edi*2 + 2]
push ecx
call fcn.00410848
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x40a570
push edi
push esi
push dword [esp + 0x18]
call fcn.00407d29
push dword [esp + 0xc]
push esi
call fcn.00410a00
pop ecx
push eax
push 1
push esi
call fcn.004107f0
push esi
call fcn.0040e343
add esp, 0x14
pop edi
pop esi
ret 8
Function at 0x40a575
Capabilities:
Accept command line arguments
Create process on windows
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x808
mov eax, dword [0x42b7a4]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
push esi
mov esi, dword [ebp + 0x794]
push edi
push 1
call fcn.00407a5e
xor ebx, ebx
mov ecx, 0x42e150
push ebx
push esi
call fcn.00407249
push str.uninstall.lng
mov ecx, 0x42e158
call fcn.0040645e
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push str.riched20.dll
call fcn.004079ff
mov edi, str.RARICON
mov esi, eax
push edi
push dword [0x42e148]
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [0x434340], eax
test eax, eax
jne 0x40a605
mov eax, dword [0x42e14c]
cmp eax, dword [0x42e148]
je 0x40a605
push edi
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [0x434340], eax
push str.MS_Shell_Dlg
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2bc
push ebx
push ebx
push ebx
push 0xfffffffffffffff4
call fcn.00409326
push eax
call dword [sym.imp.GDI32.dll_CreateFontW]
mov dword [0x434344], eax
xor eax, eax
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x78]
push 0x400
push eax
push str.sfxcmd
mov byte [ebp - 0x79], bl
mov byte [ebp - 0x7a], bl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x7a]
push eax
lea eax, [ebp - 0x79]
push eax
lea eax, [ebp - 0x78]
push eax
push 1
call fcn.004098a0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x7a]
push ecx
lea ecx, [ebp - 0x79]
push ecx
push eax
push ebx
call fcn.004098a0
cmp byte [ebp - 0x79], bl
je 0x40a737
push ebx
push 0x409af0
push ebx
push str.SETUPDLG
push dword [0x42e148]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x40a737
call fcn.00409570
cmp byte [0x435399], bl
jne 0x40a6f2
push ebx
push 0x409660
push ebx
push str.DONEDLG
push dword [0x42e148]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
call fcn.004016f0
test eax, eax
je 0x40a6f2
cmp byte [0x435398], bl
jne 0x40a6f2
push 0x40
push 0x13ed
call fcn.0040733d
push eax
push 0x140a
call fcn.0040733d
push eax
push ebx
call fcn.00409393
cmp word [0x434348], bx
je 0x40a737
cmp byte [0x435398], bl
jne 0x40a737
cmp byte [0x435399], bl
jne 0x40a737
cmp byte [0x43539a], bl
jne 0x40a737
mov edi, 0x434348
push edi
call fcn.00404576
test al, al
je 0x40a737
push 1
push 0x4204c0
push ebx
push edi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp byte [ebp - 0x7a], bl
je 0x40a741
call fcn.00409f47
test esi, esi
je 0x40a74c
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [0x434344]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [0x434340]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ecx, dword [ebp + 0x788]
mov eax, dword [0x43539c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040a986
add ebp, 0x78c
leave
ret 0x10
Function at 0x40b4a3
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40b4e2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40b4e2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40b4e2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40b4e2
cmp dword [ecx + 0x74], 0xe
jbe 0x40b4e2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x41c4ae
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041c32d

Function at 0x41f590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f5bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f5bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.00401485
lea eax, [ebp - 0x404]
push eax
call fcn.00401485
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b66
leave
ret

Function at 0x401485
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x401494
pop dword [ebp - 0x4c]
mov eax, 0x401494
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xac888bcb
add dword [ebp - 0x5c], 0xa1c9b980
mov dword [ebp - 0x58], 0x2c09cfff
add dword [ebp - 0x58], 0x6297c46
mov dword [ebp - 0x54], 0x7224ce35
add dword [ebp - 0x54], 0xda2775f9
mov dword [ebp - 0x50], 0x3859003d
add dword [ebp - 0x50], 0xc7a6ffc3
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x245dd5a5
sub eax, 0x241d0559
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xba750a94
add dword [ebp - 0x5c], 0xb9fd5ec2
mov dword [ebp - 0x58], 0x52067cf1
add dword [ebp - 0x58], 0xef65e484
mov dword [ebp - 0x54], 0xee6a6b16
add dword [ebp - 0x54], 0x75050156
mov dword [ebp - 0x50], 0xa3d8601a
sub dword [ebp - 0x50], 0xa3d8601a
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38585
push 0
call eax
mov ecx, 0x2a4c8423
add ecx, 0xd5b3bed3
mov edx, eax
mov ebx, 0x716141
sub ebx, 0x2fb141
add ebx, dword [ebp - 0x4c]
mov edi, 0xafe19e14
add edi, 0x48708528
mov esi, dword [ebx]
add dword [ebp - 8], edi
xor esi, edi
mov dword [edx], esi
sub dword [ebp - 0x1c], 0xda6ad3dd
add edx, 0x871f1c1b
add edx, 0x78e0e3e9
add ebx, 0x606a85f6
sub ebx, 0x606a85f2
loop 0x4015ac
add eax, 0x3d4dfac
add eax, 0xfc2c1eff
mov ebx, eax
add eax, 0xe3ff5299
add eax, 0x1c00ad6c
mov ecx, 0x41e04f4
add ecx, 0xfc21fb0c
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0x44101028
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x262458b3
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0xc0c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xc0c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc0c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc0c06a
add dl, dl
jne 0xc0c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc0c0dc
xor eax, eax
add dl, dl
jne 0xc0c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc0c17d
add dl, dl
jne 0xc0c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc0c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc0c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc0c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc0c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc0c075
mov eax, 1
add dl, dl
jne 0xc0c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc0c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc0c0e1
sub eax, ebx
mov ebx, 1
jne 0xc0c128
mov ecx, 1
add dl, dl
jne 0xc0c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc0c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc0c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc0c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc0c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc0c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc0c136
cmp eax, 0x7d00
jae 0xc0c16d
cmp eax, 0x500
jb 0xc0c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc0c075
cmp eax, 0x7f
ja 0xc0c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc0c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc0c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc0c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401055
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401083
push str.Could_not_open_file.
jmp 0x4010f2
push 0x407194
push str.110
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, esi
jne 0x40109f
push str.FindRes_Error
jmp 0x4010f2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, esi
jne 0x4010b9
push str.LockRes_Error
jmp 0x4010f2
push esi
lea ecx, [ebp - 4]
push ecx
mov dword [ebp - 4], esi
mov esi, 0x4a000
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4010e1
push str.FileClose_Error
jmp 0x4010f2
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], esi
je 0x4010fc
push str.Write_Error
call fcn.00401000
pop ecx
xor al, al
jmp 0x4010fe
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x401178
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x409040]
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4011af
push str.SysDir_Error
call fcn.00401000
pop ecx
or eax, 0xffffffff
jmp 0x4011e7
push esi
lea eax, [ebp - 0x204]
push str.lang.ocx
push eax
call fcn.004012a0
mov esi, eax
push esi
call fcn.00401055
add esp, 0xc
test al, al
jne 0x4011d5
push 0xfffffffffffffffe
pop eax
jmp 0x4011e6
push esi
call fcn.00401102
neg al
pop ecx
sbb eax, eax
and eax, 3
add eax, 0xfffffffd
pop esi
mov ecx, dword [ebp - 4]
call fcn.0040127c
leave
ret 0x10
Function at 0x4013ad
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x407230
call fcn.004020d8
mov edi, 0x94
mov eax, edi
call fcn.00402de0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4096dc], ecx
mov eax, dword [esi + 4]
mov dword [0x4096e8], eax
mov edx, dword [esi + 8]
mov dword [0x4096ec], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4096e0], esi
cmp ecx, 2
je 0x40140d
or esi, 0x8000
mov dword [0x4096e0], esi
shl eax, 8
add eax, edx
mov dword [0x4096e4], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x401448
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401448
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401460
cmp eax, 0x20b
je 0x40144d
mov dword [ebp - 0x1c], esi
jmp 0x401474
cmp dword [ecx + 0x84], 0xe
jbe 0x401448
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40146e
cmp dword [ecx + 0x74], 0xe
jbe 0x401448
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00402d8a
pop ecx
test eax, eax
jne 0x4014a0
cmp dword [0x4096c8], 1
jne 0x40148d
call fcn.0040253f
push 0x1c
call fcn.004023c8
push 0xff
call fcn.0040222d
pop ecx
pop ecx
call fcn.00402ce8
mov dword [ebp - 4], esi
call fcn.00402b3d
test eax, eax
jge 0x4014b9
push 0x1b
call fcn.00401388
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40ac74], eax
call fcn.00402a1b
mov dword [0x4096c0], eax
call fcn.00402979
test eax, eax
jge 0x4014df
push 8
call fcn.00401388
pop ecx
call fcn.00402746
test eax, eax
jge 0x4014f0
push 9
call fcn.00401388
pop ecx
push 1
call fcn.0040225d
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x401506
push eax
call fcn.00401388
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.004026e9
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x401527
movzx eax, word [ebp - 0x40]
jmp 0x40152a
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401178
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x401548
push edi
call fcn.00402388
call fcn.004023aa
jmp 0x40157a
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00402113
ret
Function at 0x4022c7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x40971c], esi
push edi
jne 0x4022e7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x409718], esi
mov byte [0x409714], al
jne 0x40234d
mov ecx, dword [0x40ac68]
test ecx, ecx
je 0x40232e
mov eax, dword [0x40ac64]
sub eax, 4
cmp eax, ecx
jmp 0x402327
mov eax, dword [eax]
test eax, eax
je 0x402319
call eax
mov eax, dword [0x40ac64]
sub eax, 4
cmp eax, dword [0x40ac68]
mov dword [0x40ac64], eax
jae 0x402311
mov eax, 0x409020
mov esi, 0x409028
cmp eax, esi
mov edi, eax
jae 0x40234d
mov eax, dword [edi]
test eax, eax
je 0x402346
call eax
add edi, 4
cmp edi, esi
jb 0x40233e
mov eax, 0x40902c
mov esi, 0x409030
cmp eax, esi
mov edi, eax
jae 0x40236c
mov eax, dword [edi]
test eax, eax
je 0x402365
call eax
add edi, 4
cmp edi, esi
jb 0x40235d
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x402386
push dword [ebp + 8]
mov dword [0x40971c], 1
call fcn.0040222d
pop ebp
ret

Function at 0x4023c8
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x409040]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x409060]
je 0x4023fd
inc eax
cmp eax, 0x13
jb 0x4023ee
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x409060]
jne 0x402523
mov eax, dword [0x4096c8]
cmp eax, 1
je 0x4024fb
cmp eax, edx
jne 0x40242d
cmp dword [0x409054], 1
je 0x4024fb
cmp ecx, 0xfc
je 0x402523
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402463
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00401290
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00403200
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x402497
mov eax, edi
push eax
call fcn.00403200
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x4072ec
push edi
call fcn.00403510
add esp, 0x10
push edi
call fcn.00403200
push dword [esi + 0x409064]
mov ebx, eax
call fcn.00403200
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00402de0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00401290
push edi
push ebx
call fcn.004012a0
push 0x4072e8
push ebx
call fcn.004012a0
push dword [esi + 0x409064]
push ebx
call fcn.004012a0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.00403415
add esp, 0x2c
jmp 0x402523
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x409064]
push dword [esi]
call fcn.00403200
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040127c
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret