joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005fd60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x338
push 8
push 0
mov eax, dword [ebp + 0xc]
push eax
call dword [ebp + 8]
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x1005fd89
xor eax, eax
jmp 0x1005ff57
mov ecx, dword [ebp - 0x10]
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x80
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov dword [eax], 0
mov ecx, dword [ebp - 8]
mov byte [ecx + 4], 8
mov edx, dword [ebp - 4]
mov byte [edx + 0x3c], 1
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0x3c]
and ecx, 3
mov edx, dword [ebp - 8]
mov byte [edx + 5], cl
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.10060600
add esp, 8
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x7c], ecx
mov edx, dword [ebp - 8]
push edx
call fcn.100602a0
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x38], eax
mov edx, dword [ebp - 4]
mov byte [edx + 0x3f], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x1c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x20], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x18], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x78], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x80], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x3d], 7
mov edx, dword [ebp - 4]
mov byte [edx + 0x3e], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x64], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x60], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x40], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x44], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x4c], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], 0
mov eax, dword [ebp - 4]
mov dword [eax + 0x54], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x68], 0
mov edx, dword [ebp - 4]
mov dword [edx + 8], 0x338
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], 0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x6c], 0
mov edx, dword [ebp - 4]
mov dword [edx + 0x70], 0xc8
mov eax, dword [ebp - 4]
mov dword [eax + 0x74], 0xc8
mov dword [ebp - 0xc], 0
jmp 0x1005ff11
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 9
jge 0x1005ff2a
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [eax + edx*4 + 0xe8], 0
jmp 0x1005ff08
push 0
push 0x10060590
mov ecx, dword [ebp - 8]
push ecx
call fcn.10066930
add esp, 0xc
test eax, eax
je 0x1005ff54
mov edx, dword [ebp - 8]
push edx
call fcn.100606b0
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x1009c406
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1009c27c
Function at 0x40a6b1
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42ca28], 0
jne 0x40a6ed
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004097f2
push dword [ebp + 0xc]
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004099f5
pop ecx
test esi, esi
pop esi
je 0x40a6fd
mov al, 1
jmp 0x40a6ff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x40a6e7
xor al, al
leave
ret 8

Function at 0x40a703
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42ca28], 0
jne 0x40a73b
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004097f2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004099f5
pop ecx
test esi, esi
pop esi
je 0x40a748
mov al, 1
jmp 0x40a74a
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jmp 0x40a735
xor al, al
leave
ret 4

Function at 0x40a74e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42ca28], 0
jne 0x40a789
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004097f2
mov eax, dword [eax]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004099f5
pop ecx
test esi, esi
pop esi
je 0x40a798
mov al, 1
jmp 0x40a79a
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x40a783
xor al, al
leave
ret 4

Function at 0x40a7bc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0040b3b8
cmp eax, 0xffffffff
je 0x40a7e7
test al, 0x10
jne 0x40a7e7
test al, 1
je 0x40a7e7
and eax, 0xfffffffe
push eax
push esi
call fcn.0040a6b1
test al, al
je 0x40a81f
cmp byte [0x42ca28], 0
push esi
jne 0x40a815
lea eax, [ebp - 0xc]
push eax
call fcn.004097f2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004099f5
pop ecx
test esi, esi
je 0x40a81f
mov al, 1
jmp 0x40a821
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x40a80f
xor al, al
pop esi
leave
ret 4

Function at 0x40a82b
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42ca28], 0
jne 0x40a862
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004097f2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004099f5
test esi, esi
pop ecx
setne al
pop esi
jmp 0x40a871
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
leave
ret 4
Function at 0x40ab42
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x42182e
call fcn.0041871a
xor ebx, ebx
cmp byte [0x42ca28], bl
jne 0x40ab87
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
call fcn.004097f2
mov eax, dword [eax]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.004099f5
pop ecx
cmp esi, ebx
je 0x40ab95
mov al, 1
call fcn.004187b9
ret 4
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x40ab7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40aba6
xor al, al
jmp 0x40ab7f
lea ecx, [ebp - 0x50]
call fcn.0040b395
lea ecx, [ebp - 0x28]
call fcn.00409397
push dword [ebp + 8]
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040b4a6
test al, al
jne 0x40abd5
push dword [ebp - 0x28]
call fcn.004099f5
pop ecx
mov al, bl
jmp 0x40ab7f
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
jmp 0x40abc8

Function at 0x40b3b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x42ca28], 0
jne 0x40b3ec
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.004097f2
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004099f5
pop ecx
mov eax, esi
pop esi
jmp 0x40b3fc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40b3fc
or eax, eax
leave
ret 4

Function at 0x40b921
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40b947
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40b947
xor al, al
jmp 0x40b967
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00419f20
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4
Function at 0x411a6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
and dword [ebp - 4], 0
push esi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
and esi, 7
cmp eax, 5
jae 0x411a8c
xor eax, eax
jmp 0x411ba5
add dword [ebp + 0x10], 5
push ebx
mov ebx, dword [ebp + 8]
sub eax, 4
add eax, ebx
push edi
mov dword [ebp + 0xc], eax
mov edi, dword [ebp - 4]
lea edx, [edi + ebx]
jmp 0x411aae
mov al, byte [edx]
and al, 0xfe
cmp al, 0xe8
je 0x411ab3
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x411aa5
mov ecx, edx
sub ecx, edi
mov eax, edx
sub eax, ebx
sub ecx, ebx
mov dword [ebp - 4], eax
cmp edx, dword [ebp + 0xc]
jae 0x411b8e
cmp ecx, 2
jbe 0x411b0e
xor esi, esi
movzx ecx, byte [edx + 4]
lea eax, [ecx + 1]
test al, 0xfe
jne 0x411b2c
movzx eax, byte [edx + 3]
mov edi, dword [ebp + 0x10]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 4], 5
add edi, ecx
cmp dword [ebp + 0x18], 0
je 0x411b39
add eax, edi
jmp 0x411b3b
shr esi, cl
test esi, esi
je 0x411ad0
cmp esi, 4
ja 0x411b2c
cmp esi, 3
je 0x411b2c
mov eax, esi
shr eax, 1
movzx eax, byte [eax + edx + 1]
inc eax
test al, 0xfe
jne 0x411ad0
or esi, 8
shr esi, 1
inc dword [ebp - 4]
jmp 0x411a9d
sub eax, edi
test esi, esi
je 0x411b6c
and esi, 6
shl esi, 2
mov ebx, eax
mov ecx, esi
shr ebx, cl
inc ebx
test bl, 0xfe
jne 0x411b67
mov ebx, 0x100
shl ebx, cl
dec ebx
xor eax, ebx
cmp dword [ebp + 0x18], 0
je 0x411b65
add eax, edi
jmp 0x411b67
sub eax, edi
mov ebx, dword [ebp + 8]
xor esi, esi
mov ecx, eax
shr ecx, 8
mov byte [edx + 1], al
mov byte [edx + 2], cl
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
and al, 1
neg al
mov byte [edx + 3], cl
mov byte [edx + 4], al
jmp 0x411a9d
push 2
pop eax
shr esi, cl
cmp eax, ecx
mov ecx, dword [ebp + 0x14]
sbb eax, eax
not eax
and eax, esi
pop edi
mov dword [ecx], eax
mov eax, dword [ebp - 4]
pop ebx
pop esi
leave
ret 0x14
Function at 0x411f08
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x2e8]
sub esp, 0x368
mov eax, dword [0x42bb20]
xor eax, ebp
mov dword [ebp + 0x2e4], eax
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x411f44
cmp dword [ebp - 0x7c], 6
jne 0x411f44
cmp dword [ebp - 0x78], 0
je 0x411f6a
push str.SetDefaultDllDirectories
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x411f6a
push 0xc00
call eax
test eax, eax
jne 0x411fe9
push 0x106
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x411fe9
cmp eax, 0x104
ja 0x411fe9
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [ebp + eax*2 + 0x12], 0x5c
je 0x411f9f
push 0x5c
pop ecx
mov word [ebp + eax*2 + 0x14], cx
inc eax
cmp byte [0x423e90], 0
push esi
mov esi, 0x423e90
je 0x411fe8
push edi
lea edi, [ebp + eax*2 + 0x14]
mov ecx, edi
mov al, byte [esi]
movzx dx, al
inc esi
mov word [ecx], dx
inc ecx
inc ecx
test al, al
jne 0x411fb5
push str..dll
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 8
push 0
lea eax, [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
cmp byte [esi], 0
jne 0x411fb3
pop edi
pop esi
mov ecx, dword [ebp + 0x2e4]
xor ecx, ebp
call fcn.0041870b
add ebp, 0x2e8
leave
ret
Function at 0x4161b1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
push ebp
xor eax, eax
push edi
mov edi, dword [esp + 0x10]
or dword [edi + 0x90], 0xffffffff
or dword [edi + 0x94], 0xffffffff
inc eax
push 0x20
mov dword [edi + 0x30], eax
mov dword [edi + 0x44], eax
mov eax, dword [edi + 4]
pop ebp
mov dword [edi + 0x78], ebx
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x88], ebx
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x80], ebx
mov dword [edi + 0x84], ebx
cmp eax, ebp
jbe 0x416219
mov eax, ebp
mov dword [edi + 0x54], eax
mov eax, dword [edi]
push esi
mov dword [edi + 0x58], ebx
cmp eax, dword [edi + 0x20]
je 0x416255
lea esi, [edi + 0xc8]
cmp dword [esi + 8], ebx
je 0x416238
push esi
call fcn.0041554e
add esi, 0x28
dec ebp
jne 0x41622d
mov ecx, dword [edi + 0x5c]
cmp ecx, ebx
je 0x416250
mov eax, dword [edi + 0x14]
push ecx
push eax
call dword [eax + 4]
mov dword [edi + 0x5c], ebx
mov eax, dword [edi]
mov dword [edi + 0x20], eax
push dword [edi + 0x10]
lea eax, [edi + 0x98]
push eax
call fcn.00415444
mov eax, dword [edi + 0x58]
lea esi, [eax + 5]
imul esi, esi, 0x28
add esi, edi
inc eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ebx
mov dword [edi + 0x58], eax
call fcn.004154ff
mov ebp, eax
cmp ebp, ebx
jne 0x4162ba
lea eax, [esi + 0x20]
push eax
call fcn.00416391
mov ebp, eax
cmp ebp, ebx
jne 0x4162ba
lea eax, [esi + 0x1c]
push eax
call fcn.00416391
mov ebp, eax
cmp ebp, ebx
jne 0x4162ba
push esi
call fcn.00415f5a
mov ebp, eax
cmp ebp, ebx
je 0x4162ba
mov eax, edi
mov dword [edi + 0x44], ebx
call fcn.004155b6
cmp ebp, ebx
pop esi
jle 0x4162c6
movzx ebp, bp
or ebp, 0x80070000
cmp ebp, ebx
je 0x4162cd
mov dword [edi + 0x40], ebp
cmp dword [edi + 0x38], ebx
jne 0x4162df
cmp dword [edi + 0x40], ebx
jne 0x4162df
cmp dword [edi + 0x3c], ebx
jne 0x4162df
mov dword [edi + 0x44], ebx
mov eax, dword [edi + 0x44]
neg eax
sbb eax, eax
not eax
pop edi
and eax, ebp
pop ebp
pop ebx
ret 4

Function at 0x416341
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x10]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call fcn.0041ac7d
mov ecx, dword [ebp + 8]
add esp, 0x18
push eax
mov dword [ecx], eax
call fcn.004162fc
pop ebp
ret 0xc

Function at 0x416b24
Capabilities:
Hide graphical window

Disassembly:
push 0xc
mov eax, 0x4223bd
call fcn.0041871a
mov esi, ecx
push 0
push dword [ebp + 0xc]
lea ecx, [esi + 0x68]
push dword [ebp + 8]
call fcn.00416aa9
push 0xce4
lea eax, [ebp - 0x18]
push eax
call fcn.0040e2e8
push dword [eax]
and dword [ebp - 4], 0
push dword [esi + 0x6c]
call fcn.0040c90e
push dword [ebp - 0x18]
call fcn.004099f5
pop ecx
push 1
push dword [esi + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
call fcn.004187b9
ret 8
Function at 0x41870b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42bb20]
jne 0x418715
repz ret
jmp fcn.0041caac

Function at 0x41ef18
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041b4fa
and dword [ebp - 4], 0
cmp dword [0x42d39c], 0
mov ebx, eax
jne 0x41efc9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41f07a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41f07a
push eax
call fcn.0041b488
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42d39c], eax
call esi
push eax
call fcn.0041b488
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42d3a0], eax
call esi
push eax
call fcn.0041b488
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42d3a4], eax
call esi
push eax
call fcn.0041b488
pop ecx
mov dword [0x42d3ac], eax
test eax, eax
je 0x41efc9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041b488
pop ecx
mov dword [0x42d3a8], eax
mov eax, dword [0x42d3a8]
cmp eax, ebx
je 0x41f021
cmp dword [0x42d3ac], ebx
je 0x41f021
push eax
call fcn.0041b503
push dword [0x42d3ac]
mov esi, eax
call fcn.0041b503
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41f021
test edi, edi
je 0x41f021
call esi
test eax, eax
je 0x41f018
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41f018
test byte [ebp - 0xc], 1
jne 0x41f021
or dword [ebp + 0x10], 0x200000
jmp 0x41f05a
mov eax, dword [0x42d3a0]
cmp eax, ebx
je 0x41f05a
push eax
call fcn.0041b503
pop ecx
test eax, eax
je 0x41f05a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41f05a
mov eax, dword [0x42d3a4]
cmp eax, ebx
je 0x41f05a
push eax
call fcn.0041b503
pop ecx
test eax, eax
je 0x41f05a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42d39c]
call fcn.0041b503
pop ecx
test eax, eax
je 0x41f07a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41f07c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40136d
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x405150
call fcn.004016f8
mov edi, 0x94
mov eax, edi
call fcn.00402400
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x40738c], ecx
mov eax, dword [esi + 4]
mov dword [0x407398], eax
mov edx, dword [esi + 8]
mov dword [0x40739c], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x407390], esi
cmp ecx, 2
je 0x4013cd
or esi, 0x8000
mov dword [0x407390], esi
shl eax, 8
add eax, edx
mov dword [0x407394], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x401408
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401408
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401420
cmp eax, 0x20b
je 0x40140d
mov dword [ebp - 0x1c], esi
jmp 0x401434
cmp dword [ecx + 0x84], 0xe
jbe 0x401408
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x40142e
cmp dword [ecx + 0x74], 0xe
jbe 0x401408
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.004023aa
pop ecx
test eax, eax
jne 0x401460
cmp dword [0x407378], 1
jne 0x40144d
call fcn.00401b5f
push 0x1c
call fcn.004019e8
push 0xff
call fcn.0040184d
pop ecx
pop ecx
call fcn.00402308
mov dword [ebp - 4], esi
call fcn.0040215d
test eax, eax
jge 0x401479
push 0x1b
call fcn.00401348
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4078f4], eax
call fcn.0040203b
mov dword [0x407370], eax
call fcn.00401f99
test eax, eax
jge 0x40149f
push 8
call fcn.00401348
pop ecx
call fcn.00401d66
test eax, eax
jge 0x4014b0
push 9
call fcn.00401348
pop ecx
push 1
call fcn.0040187d
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4014c6
push eax
call fcn.00401348
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00401d09
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4014e7
movzx eax, word [ebp - 0x40]
jmp 0x4014ea
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00401250
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x401508
push edi
call fcn.004019a8
call fcn.004019ca
jmp 0x40153a
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00401733
ret
Function at 0x4018e7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x4073cc], esi
push edi
jne 0x401907
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x4073c8], esi
mov byte [0x4073c4], al
jne 0x40196d
mov ecx, dword [0x4078e8]
test ecx, ecx
je 0x40194e
mov eax, dword [0x4078e4]
sub eax, 4
cmp eax, ecx
jmp 0x401947
mov eax, dword [eax]
test eax, eax
je 0x401939
call eax
mov eax, dword [0x4078e4]
sub eax, 4
cmp eax, dword [0x4078e8]
mov dword [0x4078e4], eax
jae 0x401931
mov eax, 0x40701c
mov esi, 0x407020
cmp eax, esi
mov edi, eax
jae 0x40196d
mov eax, dword [edi]
test eax, eax
je 0x401966
call eax
add edi, 4
cmp edi, esi
jb 0x40195e
mov eax, 0x407024
mov esi, 0x407028
cmp eax, esi
mov edi, eax
jae 0x40198c
mov eax, dword [edi]
test eax, eax
je 0x401985
call eax
add edi, 4
cmp edi, esi
jb 0x40197d
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x4019a6
push dword [ebp + 8]
mov dword [0x4073cc], 1
call fcn.0040184d
pop ebp
ret

Function at 0x4019e8
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x407030]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x407040]
je 0x401a1d
inc eax
cmp eax, 0x13
jb 0x401a0e
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x407040]
jne 0x401b43
mov eax, dword [0x407378]
cmp eax, 1
je 0x401b1b
cmp eax, edx
jne 0x401a4d
cmp dword [0x407038], 1
je 0x401b1b
cmp ecx, 0xfc
je 0x401b43
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401a83
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00402540
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00402770
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x401ab7
mov eax, edi
push eax
call fcn.00402770
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x405194
push edi
call fcn.00402640
add esp, 0x10
push edi
call fcn.00402770
push dword [esi + 0x407044]
mov ebx, eax
call fcn.00402770
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00402400
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00402540
push edi
push ebx
call fcn.00402550
push 0x405190
push ebx
call fcn.00402550
push dword [esi + 0x407044]
push ebx
call fcn.00402550
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0040243d
add esp, 0x2c
jmp 0x401b43
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x407044]
push dword [esi]
call fcn.00402770
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0040133a
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x40243d
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4074e4], ebx
push esi
push edi
jne 0x4024bd
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4024f8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x4074e4], eax
je 0x4024f8
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x4074e8], eax
call esi
cmp dword [0x40738c], 2
mov dword [0x4074ec], eax
jne 0x4024bd
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x4074f4], eax
je 0x4024bd
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x4074f0], eax
mov eax, dword [0x4074f0]
test eax, eax
je 0x402502
call eax
test eax, eax
je 0x4024e9
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4074f4]
test eax, eax
je 0x4024e9
test byte [ebp - 8], 1
jne 0x402502
cmp dword [0x407398], 4
jb 0x4024fc
or byte [ebp + 0x12], 0x20
jmp 0x402521
xor eax, eax
jmp 0x402531
or byte [ebp + 0x12], 4
jmp 0x402521
mov eax, dword [0x4074e8]
test eax, eax
je 0x402521
call eax
mov ebx, eax
test ebx, ebx
je 0x402521
mov eax, dword [0x4074ec]
test eax, eax
je 0x402521
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4074e4]
pop edi
pop esi
pop ebx
leave
ret