joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410770
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x432778
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
xor edi, edi
cmp eax, edi
je 0x410903
push ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
cmp ebx, edi
mov dword [esp + 0x10], ebx
je 0x4108ec
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4108ec
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x4108ec
lea eax, [esp + 0x34]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x4108ec
cmp dword [esi + 8], ebx
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
push ebp
mov ebp, dword [esp + 0x3c]
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], edx
jne 0x4108b6
lea eax, [esp + 0x28]
lea ebx, [esi + 0xc]
push eax
mov ecx, ebx
call fcn.00409620
test al, al
jne 0x4108b2
mov ecx, dword [esi + 0x10]
mov eax, dword [ebx]
sub ebp, ecx
lea ecx, [esp + 0x28]
sub edi, eax
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], ebp
call fcn.0040fbbe
mov ecx, dword [esi]
mov edx, dword [ecx]
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x58], 0
call dword [edx + 8]
push ebx
lea ecx, [esp + 0x20]
call fcn.0040fbbe
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
mov bl, 1
push edx
mov ecx, eax
mov byte [esp + 0x58], bl
call fcn.0040f99e
mov ecx, dword [esi]
mov edx, dword [ecx]
push eax
mov byte [esp + 0x54], 2
call dword [edx + 4]
lea ecx, [esp + 0x18]
mov byte [esp + 0x50], bl
call fcn.0040f875
lea ecx, [esp + 0x1c]
mov byte [esp + 0x50], 0
call fcn.0040f875
lea ecx, [esp + 0x10]
mov dword [esp + 0x50], 0xffffffff
call fcn.0040f875
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi + 8], ebx
add esi, 0xc
mov dword [esi], eax
mov eax, dword [esp + 0x34]
pop ebp
mov dword [esi + 4], ecx
pop ebx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret
pop ebx
mov dword [esi + 8], edi
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
add esp, 0x44
ret
mov ecx, dword [esp + 0x40]
pop edi
xor al, al
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret
Function at 0x412240
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4329f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x628
mov ecx, dword [ecx + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
push ecx
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4122a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.unable_to_open_Win32_clipboard
lea ecx, [ebp - 0x42c]
call fcn.004080dc
push 0x43cf90
lea eax, [ebp - 0x42c]
push eax
call fcn.0042409a
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp + 8]
push ecx
mov byte [ebp - 4], 1
call fcn.00411ec0
mov esi, eax
add esp, 4
push esi
mov dword [ebp - 0x18], esi
call fcn.00411f20
mov eax, esi
add esp, 4
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4122c8
sub eax, edx
lea edi, [eax + 1]
push edi
push 2
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, edi
mov edx, ecx
shr ecx, 2
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
push ebx
mov byte [eax + ecx], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x41233e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.unable_to_empty_Win32_clipboard
lea ecx, [ebp - 0x224]
call fcn.004080dc
push 0x43cf90
lea edx, [ebp - 0x224]
push edx
call fcn.0042409a
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x412373
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.unable_to_set_Win32_clipboard
lea ecx, [ebp - 0x634]
call fcn.004080dc
push 0x43cf90
lea eax, [ebp - 0x634]
push eax
call fcn.0042409a
push str.set_clipboard
xor esi, esi
push 0x444740
mov dword [ebp - 0x14], esi
call fcn.00402670
mov ecx, dword [ebp - 0x18]
add esp, 8
push ecx
call fcn.00424215
add esp, 4
jmp 0x4123b6
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.USER32.dll_CloseClipboard]
test eax, eax
jne 0x4123e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.unable_to_close_Win32_clipboard:__u
push 0x444740
call fcn.00402670
add esp, 0xc
jmp 0x4123f4
push str.closed_clipboard
push 0x444740
call fcn.00402670
add esp, 8
test esi, esi
je 0x412411
push str.freeing_clipboard_handle
push 0x444740
call fcn.00402670
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41fdc1
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov eax, edx
shr eax, 4
xor eax, ecx
and eax, 0xf0f0f0f
xor ecx, eax
shl eax, 4
xor edx, eax
mov eax, edx
shr eax, 0x10
xor eax, ecx
and eax, 0xffff
xor ecx, eax
shl eax, 0x10
xor edx, eax
mov eax, ecx
shr eax, 2
xor eax, edx
and eax, 0x33333333
xor edx, eax
shl eax, 2
xor ecx, eax
mov eax, ecx
shr eax, 8
xor eax, edx
and eax, 0xff00ff
xor edx, eax
shl eax, 8
xor ecx, eax
mov eax, ecx
add ecx, ecx
shr eax, 0x1f
or eax, ecx
mov ecx, eax
xor ecx, edx
and ecx, 0xaaaaaaaa
xor edx, ecx
xor eax, ecx
mov ecx, edx
push ebx
shr ecx, 0x1f
add edx, edx
push esi
or ecx, edx
mov dword [ebp - 4], 8
push edi
mov edi, dword [ebp + 0xc]
mov esi, eax
shl esi, 0x1c
mov edx, eax
shr edx, 4
or esi, edx
xor esi, dword [edi]
add edi, 4
mov edx, esi
shr edx, 0x18
mov ebx, esi
shr ebx, 0x10
and ebx, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x442910]
or edx, dword [ebx*4 + 0x442b10]
mov ebx, esi
shr ebx, 8
and ebx, 0x3f
or edx, dword [ebx*4 + 0x442d10]
and esi, 0x3f
or edx, dword [esi*4 + 0x442f10]
mov esi, dword [edi]
add edi, 4
mov dword [ebp + 0xc], edi
xor esi, eax
mov edi, esi
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x442a10]
mov ebx, esi
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x442c10]
mov ebx, esi
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x442e10]
and esi, 0x3f
or edi, dword [esi*4 + 0x443010]
or edi, edx
xor ecx, edi
mov edi, dword [ebp + 0xc]
mov esi, ecx
shl esi, 0x1c
mov edx, ecx
shr edx, 4
or esi, edx
xor esi, dword [edi]
add edi, 4
mov edx, esi
shr edx, 0x18
mov ebx, esi
shr ebx, 0x10
and ebx, 0x3f
and edx, 0x3f
mov edx, dword [edx*4 + 0x442910]
or edx, dword [ebx*4 + 0x442b10]
mov ebx, esi
shr ebx, 8
and ebx, 0x3f
or edx, dword [ebx*4 + 0x442d10]
and esi, 0x3f
or edx, dword [esi*4 + 0x442f10]
mov esi, dword [edi]
add edi, 4
mov dword [ebp + 0xc], edi
xor esi, ecx
mov edi, esi
shr edi, 0x18
and edi, 0x3f
mov edi, dword [edi*4 + 0x442a10]
mov ebx, esi
shr ebx, 0x10
and ebx, 0x3f
or edi, dword [ebx*4 + 0x442c10]
mov ebx, esi
shr ebx, 8
and ebx, 0x3f
or edi, dword [ebx*4 + 0x442e10]
and esi, 0x3f
or edi, dword [esi*4 + 0x443010]
or edi, edx
xor eax, edi
dec dword [ebp - 4]
jne 0x41fe43
mov edx, eax
shr eax, 1
shl edx, 0x1f
or edx, eax
mov eax, edx
xor eax, ecx
and eax, 0xaaaaaaaa
xor ecx, eax
xor edx, eax
mov esi, ecx
shl esi, 0x1f
shr ecx, 1
or esi, ecx
mov eax, esi
shr eax, 8
xor eax, edx
and eax, 0xff00ff
xor edx, eax
shl eax, 8
xor esi, eax
mov eax, esi
shr eax, 2
xor eax, edx
and eax, 0x33333333
xor edx, eax
shl eax, 2
xor esi, eax
mov ecx, dword [ebp + 8]
mov eax, edx
shr eax, 0x10
xor eax, esi
and eax, 0xffff
xor esi, eax
shl eax, 0x10
xor edx, eax
mov eax, edx
shr eax, 4
xor eax, esi
and eax, 0xf0f0f0f
mov edi, eax
shl edi, 4
xor edi, edx
mov dword [ecx], edi
pop edi
xor eax, esi
pop esi
mov dword [ecx + 4], eax
pop ebx
leave
ret
Function at 0x42010a
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
push ebx
push esi
xor ebx, ebx
push edi
xor ecx, ecx
movzx eax, byte [ecx + str.80_]
mov esi, dword [ebp + 8]
mov edx, eax
sar edx, 3
mov dl, byte [edx + esi]
and eax, 7
test byte [eax*2 + 0x442828], dl
setne al
mov byte [ebp + ecx - 0x78], al
inc ecx
cmp ecx, 0x38
jl 0x42011a
mov dword [ebp - 4], ebx
mov dword [ebp - 8], 0x1e
cmp dword [ebp + 0xc], 1
jne 0x420158
mov eax, dword [ebp - 8]
jmp 0x42015d
mov eax, dword [ebp - 4]
add eax, eax
lea ecx, [ebp + eax*4 - 0xf4]
lea esi, [ebp + eax*4 - 0xf8]
mov eax, dword [ebp - 4]
movzx eax, byte [eax + 0x4428d0]
mov dword [ecx], ebx
mov dword [esi], ebx
xor edx, edx
mov edi, eax
cmp edi, 0x1c
jge 0x420188
mov bl, byte [ebp + edi - 0x78]
jmp 0x42018f
mov bl, byte [ebp + edi - 0x94]
mov byte [ebp + edx - 0x40], bl
inc edx
inc edi
cmp edx, 0x1c
jl 0x42017d
push 0x1c
pop edi
add eax, edi
cmp eax, 0x38
jge 0x4201aa
mov dl, byte [ebp + eax - 0x78]
jmp 0x4201b1
mov dl, byte [ebp + eax - 0x94]
mov byte [ebp + edi - 0x40], dl
inc edi
inc eax
cmp edi, 0x38
jl 0x42019f
xor ebx, ebx
xor eax, eax
lea edx, [eax + 0x4428f8]
movzx edi, byte [edx - 0x18]
cmp byte [ebp + edi - 0x40], bl
je 0x4201d9
mov edi, dword [eax*4 + 0x442838]
or dword [esi], edi
movzx edx, byte [edx]
cmp byte [ebp + edx - 0x40], bl
je 0x4201eb
mov edx, dword [eax*4 + 0x442838]
or dword [ecx], edx
inc eax
cmp eax, 0x18
jl 0x4201c0
sub dword [ebp - 8], 2
inc dword [ebp - 4]
cmp dword [ebp - 8], 0xfffffffe
jg 0x42014d
lea eax, [ebp - 0xf8]
push eax
call fcn.0041ffe6
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42021e
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov eax, 0x4330c5
call fcn.00425878
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
xor ebx, ebx
push 0x100
mov dword [esp + 0x20], ebx
mov dword [esi], 0x43a598
mov dword [esi + 0x10], ebx
call fcn.0042479d
mov ebp, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
pop ecx
push ebx
push 1
push ebx
lea edi, [esi + 0x14]
push ebx
push edi
mov dword [esi + 0xc], eax
mov dword [esi + 8], eax
mov dword [esi + 4], eax
mov dword [edi], ebx
call ebp
test eax, eax
jne 0x4202a1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x42028e
push 8
push 1
push ebx
push ebx
push edi
call ebp
test eax, eax
jne 0x4202a1
push str.RandomStream:_unable_to_create_keyset_n
jmp 0x420293
push str.RandomStream:_unable_to_acquire_context_n
push 0x443210
call fcn.00424fa5
pop ecx
pop ecx
mov dword [edi], ebx
cmp dword [edi], ebx
jne 0x4202ec
push str.RandomStream:_warning:_no_OS_supplied_random_source___using_rand___n
push 0x443210
call fcn.00424fa5
push ebx
call fcn.004253fb
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add esp, 0xc
mov ebx, eax
call edi
imul eax, eax, 0xf1206
add ebx, eax
call fcn.00426775
add ebx, eax
call edi
add eax, dword [0x444d38]
add eax, ebx
push eax
mov dword [0x444d38], eax
call fcn.00426768
pop ecx
mov ecx, dword [esp + 0x14]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x420ad9
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
lea eax, [ebp - 0x398]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x420b27
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.unable_to_initialise_Winsock2
lea ecx, [ebp - 0x208]
call fcn.004080dc
push 0x4402ac
lea eax, [ebp - 0x208]
push eax
mov dword [ebp - 0x208], 0x43a73c
call fcn.0042409a
leave
ret
Function at 0x421652
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
xor esi, esi
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
cmp edi, esi
jne 0x421690
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.gethostbyname
lea ecx, [ebp - 0x20c]
call fcn.004080dc
push 0x43cf90
lea eax, [ebp - 0x20c]
jmp 0x4216b7
cmp word [edi + 8], 2
je 0x4216bd
push str.rdr::Exception
push str.getMyAddresses:_bad_family
lea ecx, [ebp - 0x208]
call fcn.00401120
push 0x43cf08
lea eax, [ebp - 0x208]
push eax
call fcn.0042409a
mov eax, dword [edi + 0xc]
mov eax, dword [eax]
cmp eax, esi
je 0x42170e
push ebx
mov ebx, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
mov dword [ebp + 8], eax
call fcn.00425370
inc eax
push eax
call fcn.0042421a
push dword [ebp + 8]
mov dword [ebp - 4], eax
push eax
call fcn.00425780
mov eax, dword [ebx + 4]
add esp, 0x10
lea ecx, [ebp - 4]
push ecx
push eax
mov ecx, ebx
call fcn.004038b0
mov eax, dword [edi + 0xc]
add esi, 4
mov eax, dword [esi + eax]
test eax, eax
jne 0x4216ca
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x421d03
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x24]
mov dword [ebp - 0xc], edi
jmp 0x421d16
mov edi, dword [ebp - 0xc]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp - 8], eax
jne 0x421d35
test ecx, ecx
jne 0x421d43
test edx, edx
jne 0x421d43
mov dword [ebp - 8], edi
jmp 0x421dad
cmp eax, 0xffffffff
jne 0x421d43
mov dword [ebp - 8], 0xfffffffe
jmp 0x421dad
mov eax, dword [esi + 0x24]
lea eax, [edi + eax - 0x106]
cmp ecx, eax
jb 0x421dad
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.00425440
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x421d74
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x421d93
add dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x421e53
mov ebx, dword [esi + 0x6c]
add ebx, dword [esi + 0x64]
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 8]
add ebx, dword [esi + 0x30]
cmp eax, ecx
mov dword [ebp - 4], eax
jbe 0x421dd2
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jne 0x421ddc
xor eax, eax
jmp 0x421e14
sub eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
cmp dword [eax + 0x18], 0
jne 0x421dfe
push dword [ebp - 4]
push dword [edi]
push dword [edi + 0x30]
call fcn.0042281e
add esp, 0xc
mov dword [edi + 0x30], eax
push dword [ebp - 4]
push dword [edi]
push ebx
call fcn.00425440
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x6c], eax
mov edi, dword [esi + 0x6c]
cmp edi, 3
jb 0x421e3f
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x50]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp edi, 0x106
jae 0x421e53
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x421d13
pop edi
pop ebx
leave
ret
Function at 0x4251ad
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x43b540
call fcn.00426660
mov edi, 0x94
mov eax, edi
call fcn.00425e00
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x444d64], ecx
mov eax, dword [esi + 4]
mov dword [0x444d70], eax
mov edx, dword [esi + 8]
mov dword [0x444d74], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x444d68], esi
cmp ecx, 2
je 0x42520d
or esi, 0x8000
mov dword [0x444d68], esi
shl eax, 8
add eax, edx
mov dword [0x444d6c], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x425246
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x425246
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x42525e
cmp eax, 0x20b
je 0x42524b
mov dword [ebp - 0x1c], edi
jmp 0x425272
cmp dword [ecx + 0x84], 0xe
jbe 0x425246
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x42526c
cmp dword [ecx + 0x74], 0xe
jbe 0x425246
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004284e0
pop ecx
test eax, eax
jne 0x425286
push 0x1c
call fcn.00425189
pop ecx
call fcn.004274cc
test eax, eax
jne 0x425297
push 0x10
call fcn.00425189
pop ecx
call fcn.00429c21
mov dword [ebp - 4], edi
call fcn.0042927d
test eax, eax
jge 0x4252b0
push 0x1b
call fcn.00425164
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x445634], eax
call fcn.00429aff
mov dword [0x444d54], eax
call fcn.00429a5d
test eax, eax
jge 0x4252d6
push 8
call fcn.00425164
pop ecx
call fcn.0042982a
test eax, eax
jge 0x4252e7
push 9
call fcn.00425164
pop ecx
push 1
call fcn.00425c38
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x4252fd
push eax
call fcn.00425164
pop ecx
mov eax, dword [0x444d84]
mov dword [0x444d88], eax
push eax
push dword [0x444d7c]
push dword [0x444d78]
call fcn.004045d0
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x42532c
push esi
call fcn.00425d65
call fcn.00425d87
jmp 0x42535e
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.0042669b
ret
Function at 0x425ca2
Capabilities:
Terminate process

Disassembly:
push 8
push 0x43b568
call fcn.00426660
push 8
call fcn.004269a5
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x444da4], esi
jne 0x425cd6
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x444da0], esi
mov al, byte [ebp + 0x10]
mov byte [0x444d9c], al
cmp dword [ebp + 0xc], edi
jne 0x425d20
cmp dword [0x44562c], edi
je 0x425d10
mov eax, dword [0x445628]
sub eax, 4
mov dword [0x445628], eax
cmp eax, dword [0x44562c]
jb 0x425d10
mov eax, dword [eax]
cmp eax, edi
je 0x425cf1
call eax
jmp 0x425cf1
push 0x4421e8
mov eax, 0x4421e0
call fcn.00425c20
pop ecx
push 0x4421f4
mov eax, 0x4421ec
call fcn.00425c20
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x425d51
cmp dword [ebp + 0x10], edi
jne 0x425d5f
mov dword [0x444da4], esi
push dword [ebp + 8]
call fcn.00425bde
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x425d5e
push 8
call fcn.004268f0
pop ecx
ret
call fcn.0042669b
ret
Function at 0x429054
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x429082
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x429089
cmp ebx, dword [eax + 4]
jae 0x429089
xor eax, eax
jmp 0x429279
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x42909a
xor eax, eax
inc eax
jmp 0x429278
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4290b0
cmp ecx, edx
jae 0x4291f5
cmp dword [eax + 4], 0
je 0x4290b9
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4290a1
cmp dword [ebp + 8], 0
je 0x4290db
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x4291f5
cmp eax, esi
jae 0x4291f5
mov eax, dword [0x444f28]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x429100
cmp dword [esi*4 + 0x444f30], edi
je 0x4291f9
inc esi
cmp esi, eax
jl 0x4290ee
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x429275
cmp dword [ebp - 8], 0x1000000
jne 0x429275
test byte [ebp - 0xc], 0xcc
je 0x42917e
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x429275
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x429275
cmp word [eax + 0x18], 0x10b
jne 0x429275
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x429275
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x42917e
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x42917e
test byte [ecx + 0x27], 0x80
jne 0x4291f5
push 1
push 0x444f70
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x429092
mov ecx, dword [0x444f28]
test ecx, ecx
mov edx, ecx
jle 0x4291b2
lea eax, [ecx*4 + 0x444f2c]
cmp dword [eax], edi
je 0x4291b2
dec edx
sub eax, 4
test edx, edx
jg 0x4291a6
test edx, edx
jne 0x4291e3
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4291bf
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4291d7
lea eax, [edx*4 + 0x444f30]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4291c5
cmp ecx, 0x10
jge 0x4291e3
inc ecx
mov dword [0x444f28], ecx
push 0
push 0x444f70
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x429092
xor eax, eax
jmp 0x429278
test esi, esi
jle 0x429092
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x444f70
call ebx
test eax, eax
jne 0x429092
cmp dword [esi*4 + 0x444f30], edi
je 0x42924f
mov eax, dword [0x444f28]
lea esi, [eax - 1]
test esi, esi
jl 0x42923d
cmp dword [esi*4 + 0x444f30], edi
je 0x429239
dec esi
jns 0x42922d
test esi, esi
jge 0x42924d
cmp eax, 0x10
jge 0x429248
inc eax
mov dword [0x444f28], eax
lea esi, [eax - 1]
jmp 0x42924f
je 0x429267
xor ecx, ecx
test esi, esi
jl 0x429267
lea eax, [ecx*4 + 0x444f30]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x429255
push 0
push 0x444f70
call ebx
jmp 0x429092
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x429516
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4435a4]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x443778]
je 0x42954b
inc eax
cmp eax, 0x13
jb 0x42953c
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x443778]
jne 0x429671
mov eax, dword [0x444d5c]
cmp eax, 1
je 0x429649
cmp eax, edx
jne 0x42957b
cmp dword [0x443454], 1
je 0x429649
cmp ecx, 0xfc
je 0x429671
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4295b1
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00425780
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00425370
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4295e5
mov eax, edi
push eax
call fcn.00425370
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x43bcc8
push edi
call fcn.00425960
add esp, 0x10
push edi
call fcn.00425370
push dword [esi + 0x44377c]
mov ebx, eax
call fcn.00425370
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00425e00
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00425780
push edi
push ebx
call fcn.00425790
push 0x43bca8
push ebx
call fcn.00425790
push dword [esi + 0x44377c]
push ebx
call fcn.00425790
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0042cf75
add esp, 0x2c
jmp 0x429671
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x44377c]
push dword [esi]
call fcn.00425370
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.0042ca77
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret