joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405408
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424b2c]
jne 0x405412
repz ret
jmp fcn.00407e9c

Function at 0x407585
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402aaf
and dword [ebp - 4], 0
cmp dword [0x4293bc], 0
mov ebx, eax
jne 0x407636
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4076e7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4076e7
push eax
call fcn.00402a3d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4293bc], eax
call esi
push eax
call fcn.00402a3d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4293c0], eax
call esi
push eax
call fcn.00402a3d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4293c4], eax
call esi
push eax
call fcn.00402a3d
pop ecx
mov dword [0x4293cc], eax
test eax, eax
je 0x407636
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402a3d
pop ecx
mov dword [0x4293c8], eax
mov eax, dword [0x4293c8]
cmp eax, ebx
je 0x40768e
cmp dword [0x4293cc], ebx
je 0x40768e
push eax
call fcn.00402ab8
push dword [0x4293cc]
mov esi, eax
call fcn.00402ab8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40768e
test edi, edi
je 0x40768e
call esi
test eax, eax
je 0x407685
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407685
test byte [ebp - 0xc], 1
jne 0x40768e
or dword [ebp + 0x10], 0x200000
jmp 0x4076c7
mov eax, dword [0x4293c0]
cmp eax, ebx
je 0x4076c7
push eax
call fcn.00402ab8
pop ecx
test eax, eax
je 0x4076c7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4076c7
mov eax, dword [0x4293c4]
cmp eax, ebx
je 0x4076c7
push eax
call fcn.00402ab8
pop ecx
test eax, eax
je 0x4076c7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4293bc]
call fcn.00402ab8
pop ecx
test eax, eax
je 0x4076e7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4076e9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4053e0
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ecx
push esi
push edi
sub esp, 8
mov esi, eax
mov edi, edx
xor edx, edx
mov ecx, eax
inc eax
cmp byte [ecx], 0
je 0x4053f7
inc edx
jmp 0x4053ec
push 0
lea eax, [esp + 4]
push eax
push edx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea eax, [esp + 4]
push eax
push 2
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffff4
mov word [esp + 0x18], 0xa0d
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, edi
jmp 0x402390

Function at 0x405b80
Capabilities:
Set environment variable

Disassembly:
push ebx
push ecx
push esi
push edi
push ebp
sub esp, 4
mov dword [esp], eax
mov edi, edx
cmp word [0x42690e], 0x8000
jb 0x405bf7
call fcn.00403e6d
add eax, eax
lea ecx, [eax + 1]
mov eax, ecx
call fcn.004039d0
mov edx, eax
mov ebp, eax
test eax, eax
je 0x405bee
test edi, edi
jne 0x405c01
xor esi, esi
mov edx, dword [esp]
mov ebx, ecx
mov eax, ebp
call fcn.00405ce0
cmp eax, 0xffffffff
je 0x405c25
test esi, esi
jne 0x405c42
push esi
push ebp
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
mov edx, eax
mov eax, ebp
call fcn.00402ad0
test esi, esi
je 0x405bec
mov eax, esi
call fcn.00402ad0
mov eax, edx
add esp, 4
pop ebp
pop edi
pop esi
pop ecx
pop ebx
ret
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
jmp 0x405bee
mov eax, edi
call fcn.00403e6d
add eax, eax
lea ecx, [eax + 1]
mov eax, ecx
call fcn.004039d0
mov esi, eax
test eax, eax
jne 0x405bb7
mov eax, edx
call fcn.00402ad0
xor eax, eax
jmp 0x405bee
mov eax, ebp
call fcn.00402ad0
test esi, esi
je 0x405c37
mov eax, esi
call fcn.00402ad0
xor eax, eax
add esp, 4
pop ebp
pop edi
pop esi
pop ecx
pop ebx
ret
mov ebx, ecx
mov edx, edi
mov eax, esi
call fcn.00405ce0
cmp eax, 0xffffffff
jne 0x405bd0
mov eax, esi
call fcn.00402ad0
xor eax, eax
add esp, 4
pop ebp
pop edi
pop esi
pop ecx
pop ebx
ret
Function at 0x8e1134
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e113a
pop ebp
sub ebp, 6
sub ebp, 0x4e1134
jmp 0x8e1198
jmp 0x8e11a1
mov eax, 0x4e1134
add eax, ebp
add eax, 0x93
mov ecx, 0x613
mov edx, 0x9f22ba1a
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e11b8
jmp 0x8e11cb
jo 0x8e1227
jb 0x8e11e9
or bl, byte [edx]
sbb dh, byte [edx + 0x1a]
salc
sbb ch, byte ss:[ecx]
fimul dword [edx - 0x1b]
invalid
wait
fnclex
sbb bl, byte [edx]
sbb bl, byte [ecx]
xlatb
mov byte [0x1a1a1a1c], al
mov al, byte [0x1a1a1a32]
in eax, dx
clc
sbb edx, edx
xchg ecx, eax
wait
push ss
sbb bl, byte [edx]
sbb bl, byte [ecx]
fisttp word [edx + 0x72]
sub ebp, dword [0x1b721a13]
rcr byte [esi + 0x1a], 0x1b
jb 0x8e1231
sbb bl, byte [edx]
sbb dh, dl
pop ds
sbb bl, byte [edx]
sbb dh, bl
xor bl, byte [edx]
sbb bl, byte [edx]
dec edi
dec esi
inc edi
xchg ecx, eax
lahf
adc bl, byte [edx]
sbb bl, byte [edx]
xchg ecx, eax
invalid
sbb bl, byte [edx]
xchg ecx, eax
xchg edi, eax
or bl, byte [edx]
sbb bl, byte [edx]
fcomi st(3)
sbb byte [ebx], ch
sbb byte [ecx + 0x15531ed8], bl
lahf
out dx, al
in eax, 0xe5
in eax, 0x47
in eax, 0xe5
inc edi
fcom dword [esi]
sbb dl, byte [ecx + 0x1a1e3e96]
sbb bl, byte [edx]
jb 0x8e1280
sub eax, 0x1b721a13
rcr byte [esi + 0x1a], 0x1b
dec ebx
pop ds
sbb bl, byte [edx]
sbb dh, bl
sub dword [eax], ebx
sbb bl, byte [edx]
dec edi
dec esi
inc edi
in eax, 0x6f
push ss
in eax, 0x6f
adc dh, dl
jl 0x8e1291
sbb bl, byte [edx]
xchg ecx, eax
cmpsd dword [esi], dword es:[edi]
adc bl, byte [edx]
sbb bl, byte [edx]
sub ebx, edx
sub eax, ecx
cdq
pop ds
shr dword [ecx], cl
enter 0xfffffffffffff299, 0x1f
push edx
adc eax, 0x1a1a549e
sbb dl, byte [0x1a1a5292]
sbb bl, byte [edx]
jl 0x8e1226
sbb bh, byte [ecx + edx*4 + 6]
push es
and ebx, dword [edx - 0x61ea0d1f]
add byte [edx], bl
sbb bl, byte [edx]
lcall 0x1a0b, 0x9e15f3e1
sbb bl, byte [edx]
jl 0x8e1246
loope 0x8e1292
aas
adc eax, 0x1a1a0f9e
sbb bl, byte [ebx - 0xd]
salc
in eax, 0xe5
in eax, 0x33
push esi
and ebx, dword [ebx]
cdq
fistp dword [edi]
cdq
push ds
repe cmpsd dword [esi], dword es:[edi]
in eax, 0xe5
in eax, 0x33
dec esi
and ebx, dword [eax]
cdq
fistp dword [ecx + ebx*4]
invalid
Function at 0x4010ce
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x400
push ebx
push ebp
mov ebp, dword [esp + 0x40c]
push esi
push edi
mov ebx, 0x104
push ebx
mov esi, 0x40f6a0
push esi
mov edi, 0x3e8
push edi
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x400
lea eax, [esp + 0x14]
push eax
push 2
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push ebx
push esi
push esi
lea eax, [esp + 0x1c]
push eax
push ebp
call fcn.00401028
add esp, 0x14
cmp eax, 1
jne 0x40114d
push esi
push edi
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 0
push 0xfa
push 0xc5
push edi
push ebp
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x400
ret

Function at 0x401158
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
push esi
push 0x104
mov esi, 0x40f6a0
push esi
push 0x3e8
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push esi
call fcn.00408240
mov al, byte [eax + 0x40f69f]
cmp al, 0x5c
pop ecx
je 0x40121a
cmp al, 0x2f
je 0x40121a
push edi
mov edi, 0x40d158
push edi
push esi
call fcn.00408150
mov ebx, 0x40f8a8
push ebx
push esi
call fcn.00408150
push edi
push esi
call fcn.00408150
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop edi
je 0x40121a
test al, 0x10
je 0x40121a
push 0x400
lea eax, [ebp - 0x400]
push eax
push 3
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
push ebx
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x24
push ebx
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x40121a
xor eax, eax
jmp 0x40121d
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x4012c5
Capabilities:
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push ebx
push esi
mov esi, 0x104
push esi
xor ebx, ebx
lea eax, [ebp - 0x110]
push ebx
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], esi
call fcn.004080e0
push esi
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.004080e0
add esp, 0x18
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [ebp - 0x213], 0x3a
jne 0x40132b
movsx eax, byte [ebp - 0x214]
push eax
call fcn.00408344
pop ecx
mov byte [ebp - 0x214], al
push 0x40f9b0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x401407
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 8]
push eax
push str.BaseLocation
push str.SoftwareEnterbrainRPGXP
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea eax, [ebp - 0x110]
push 0x40d163
push eax
call fcn.004082cb
test eax, eax
pop ecx
pop ecx
jne 0x4013d2
push esi
lea eax, [ebp - 0x318]
push ebx
push eax
call fcn.004080e0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4013d2
lea eax, [ebp - 0x318]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00408140
lea eax, [ebp - 0x110]
push str.RPGXP
push eax
call fcn.00408150
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
call fcn.00408240
cmp eax, 3
pop ecx
jle 0x4013f2
lea eax, [ebp + eax - 0x111]
cmp byte [eax], 0x5c
jne 0x4013f2
mov byte [eax], bl
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.00408140
pop ecx
pop ecx
lea eax, [ebp - 0x214]
push eax
mov esi, 0x3e8
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push ebx
push 0xfa
push 0xc5
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
pop esi
pop ebx
leave
ret
Function at 0x401506
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
xor ebx, ebx
push ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x40152b
xor eax, eax
inc eax
jmp 0x4015de
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0xb7
jne 0x401543
xor eax, eax
inc eax
jmp 0x4015dd
call edi
cmp eax, 3
je 0x401551
xor eax, eax
jmp 0x4015dd
push ebx
push ebx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0040841b
push ebx
push ebx
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00408563
lea eax, [ebp - 0x108]
push eax
call fcn.00408240
add esp, 0x2c
test eax, eax
jbe 0x4015bc
lea eax, [ebp - 0x108]
lea edi, [ebp - 0x108]
push eax
dec edi
call fcn.00408240
cmp byte [eax + edi], 0x5c
pop ecx
jne 0x4015bc
lea eax, [ebp - 0x108]
push eax
call fcn.00408240
pop ecx
mov byte [eax + edi], bl
lea eax, [ebp - 0x108]
push eax
call fcn.00401506
test eax, eax
pop ecx
je 0x40154a
push ebx
push dword [ebp + 8]
call esi
neg eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40184d
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
lea eax, [ebp - 0x114]
push 0x40fec8
push eax
call fcn.00408140
mov esi, dword [ebp + 0xc]
push dword [esi + 4]
lea eax, [ebp - 0x114]
push eax
call fcn.00408150
push dword [esi + 0x14]
call fcn.00408ecd
add esp, 0x14
push 0
push 0x80
push 3
push 0
push 1
push 0xc0000000
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4018f1
lea eax, [ebp - 0x10]
push eax
xor eax, eax
mov ax, word [esi + 0x1a]
push eax
xor eax, eax
mov ax, word [esi + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
cmp eax, 1
jne 0x4018ea
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
cmp eax, 1
jne 0x4018ea
lea eax, [ebp - 8]
push eax
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov al, byte [esi + 0x1c]
and eax, 0x27
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
inc eax
pop esi
leave
ret
Function at 0x40339c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ecx
push edx
push esi
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, ecx
cmp edx, 4
jl 0x4033e3
cmp edx, 0x10
jl 0x4033cf
shr ecx, 4
nop
xor eax, dword [ebx]
mov esi, dword [ebx + 4]
xor eax, dword [ebx + 8]
xor esi, dword [ebx + 0xc]
add ebx, 0x10
xor eax, esi
dec ecx
jne 0x4033bc
mov ecx, edx
shr ecx, 2
and ecx, 3
test ecx, ecx
je 0x4033e3
xor eax, dword [ebx]
add ebx, 4
dec ecx
jne 0x4033db
and edx, 3
cmp edx, 3
jne 0x4033f7
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 0x10
xor eax, ecx
jmp 0x4033fc
cmp edx, 2
jne 0x403408
xor ecx, ecx
mov cl, byte [ebx]
inc ebx
shl ecx, 8
xor eax, ecx
jmp 0x40340d
cmp edx, 1
jne 0x403413
xor ecx, ecx
mov cl, byte [ebx]
xor eax, ecx
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4086af
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
cmp esi, dword [0x412858]
push edi
jae 0x408884
mov eax, esi
sar eax, 5
lea edi, [eax*4 + 0x412860]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
add eax, esi
mov dl, byte [eax + 4]
test dl, 1
je 0x408884
and dword [ebp - 0xc], 0
cmp dword [ebp + 0x10], 0
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
je 0x40875a
test dl, 2
jne 0x40875a
test dl, 0x48
je 0x408724
cmp byte [eax + 5], 0xa
je 0x408724
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea ecx, [ebx + 1]
mov dword [ebp - 0xc], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push ecx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40876d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
cmp eax, ecx
jne 0x408755
mov dword [0x411280], ecx
jmp 0x40888b
cmp eax, 0x6d
jne 0x408761
xor eax, eax
jmp 0x408898
push eax
call fcn.0040a79f
pop ecx
jmp 0x408895
mov eax, dword [ebp - 0x10]
mov ecx, dword [edi]
add dword [ebp - 0xc], eax
test byte [ecx + esi + 4], 0x80
je 0x40887f
test eax, eax
je 0x408794
cmp byte [ebx], 0xa
jne 0x408794
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40879d
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
add ecx, eax
cmp eax, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
jae 0x408879
mov eax, dword [ebp - 8]
mov al, byte [eax]
cmp al, 0x1a
je 0x408869
cmp al, 0xd
je 0x4087cf
mov byte [ebx], al
inc ebx
inc dword [ebp - 8]
jmp 0x40885b
dec ecx
cmp dword [ebp - 8], ecx
jae 0x4087e9
mov eax, dword [ebp - 8]
inc eax
cmp byte [eax], 0xa
jne 0x4087e4
add dword [ebp - 8], 2
jmp 0x40883d
mov dword [ebp - 8], eax
jmp 0x408857
inc dword [ebp - 8]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x408811
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408857
cmp dword [ebp - 0x10], 0
je 0x408857
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x408832
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40883d
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x40885a
cmp ebx, dword [ebp + 0xc]
jne 0x408842
cmp byte [ebp - 1], 0xa
jne 0x408842
mov byte [ebx], 0xa
jmp 0x40885a
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040889d
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x40885b
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 8], ecx
jb 0x4087b3
jmp 0x408879
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x408879
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp - 0xc]
jmp 0x408898
and dword [0x411280], 0
mov dword [0x41127c], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408cdd
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov ecx, dword [ebp + 0x3a4]
cmp ecx, dword [0x412858]
mov eax, dword [0x40f550]
push ebx
push esi
mov dword [ebp + 0x398], eax
push edi
jae 0x408ea3
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x412860]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x408ea3
xor edi, edi
cmp dword [ebp + 0x3ac], edi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], edi
jne 0x408d47
xor eax, eax
jmp 0x408eb7
test al, 0x20
je 0x408d58
push 2
push edi
push edi
push ecx
call fcn.0040accf
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x408e2d
cmp dword [ebp + 0x3ac], edi
mov eax, dword [ebp + 0x3a8]
mov dword [ebp - 0x70], eax
mov dword [ebp + 0x3a4], edi
jbe 0x408e74
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp + 0x3a8]
lea eax, [ebp - 0x6c]
cmp ecx, dword [ebp + 0x3ac]
jae 0x408dba
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x408dab
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x408d8d
mov edi, eax
lea eax, [ebp - 0x6c]
sub edi, eax
push 0
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x6c]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408dfa
mov eax, dword [ebp - 0x78]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x408e06
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp + 0x3a8]
xor edi, edi
cmp eax, dword [ebp + 0x3ac]
jb 0x408d81
jmp 0x408e08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
xor edi, edi
mov eax, dword [ebp - 0x74]
cmp eax, edi
jne 0x408e9e
cmp dword [ebp + 0x3a4], edi
je 0x408e74
push 5
pop eax
cmp dword [ebp + 0x3a4], eax
jne 0x408e66
mov dword [0x411280], eax
jmp 0x408eaa
push edi
lea ecx, [ebp - 0x78]
push ecx
push dword [ebp + 0x3ac]
push dword [ebp + 0x3a8]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x408e58
mov eax, dword [ebp - 0x78]
mov dword [ebp + 0x3a4], edi
mov dword [ebp - 0x74], eax
jmp 0x408e08
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x3a4], eax
jmp 0x408e08
push dword [ebp + 0x3a4]
call fcn.0040a79f
pop ecx
jmp 0x408eb4
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x408e8c
mov eax, dword [ebp + 0x3a8]
cmp byte [eax], 0x1a
je 0x408d40
mov dword [0x41127c], 0x1c
mov dword [0x411280], edi
jmp 0x408eb4
sub eax, dword [ebp - 0x7c]
jmp 0x408eb7
and dword [0x411280], 0
mov dword [0x41127c], 9
or eax, 0xffffffff
mov ecx, dword [ebp + 0x398]
pop edi
pop esi
pop ebx
call fcn.0040ad9f
add ebp, 0x39c
leave
ret
Function at 0x408fa5
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x40d2c0
call fcn.0040b5ac
mov edi, 0x94
mov eax, edi
call fcn.00408ca0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x411288], ecx
mov eax, dword [esi + 4]
mov dword [0x411294], eax
mov edx, dword [esi + 8]
mov dword [0x411298], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x41128c], esi
cmp ecx, 2
je 0x409005
or esi, 0x8000
mov dword [0x41128c], esi
shl eax, 8
add eax, edx
mov dword [0x411290], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x409040
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x409040
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x409058
cmp eax, 0x20b
je 0x409045
mov dword [ebp - 0x1c], esi
jmp 0x40906c
cmp dword [ecx + 0x84], 0xe
jbe 0x409040
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x409066
cmp dword [ecx + 0x74], 0xe
jbe 0x409040
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00409a75
pop ecx
test eax, eax
jne 0x409098
cmp dword [0x411248], 1
jne 0x409085
call fcn.0040af24
push 0x1c
call fcn.0040adad
push 0xff
call fcn.0040a604
pop ecx
pop ecx
call fcn.0040b522
mov dword [ebp - 4], esi
call fcn.0040a7fe
test eax, eax
jge 0x4090b1
push 0x1b
call fcn.00408f80
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x412bc0], eax
call fcn.0040b400
mov dword [0x411240], eax
call fcn.0040b35e
test eax, eax
jge 0x4090d7
push 8
call fcn.00408f80
pop ecx
call fcn.0040b12b
test eax, eax
jge 0x4090e8
push 9
call fcn.00408f80
pop ecx
push 1
call fcn.0040a634
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4090fe
push eax
call fcn.00408f80
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040b0ce
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x40911f
movzx eax, word [ebp - 0x40]
jmp 0x409122
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004014ac
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x409140
push edi
call fcn.0040a75f
call fcn.0040a781
jmp 0x409172
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0040b5e7
ret