joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408690
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x431dab
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x43fcc0]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push edi
mov eax, dword [0x43fcc0]
xor eax, esp
push eax
lea eax, [esp + 0x118]
mov dword fs:[0], eax
mov esi, ecx
call fcn.0041185d
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4086e5
push 0x80004005
call fcn.00401090
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0xc], eax
push 0
push 0x26
lea ecx, [esp + 0x18]
push ecx
push 0
mov dword [esp + 0x130], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.FastEnter.exe
push str.FastEnter
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push str._s_s_s
push eax
call fcn.004020b0
mov eax, dword [esi + 0xc0]
push str.FastEnter
push eax
call fcn.0041d507
mov edi, dword [esp + 0x28]
add esp, 0x1c
test eax, eax
sete al
test al, al
je 0x40875b
push 1
push 0
push str._updater
jmp 0x408781
mov esi, dword [esi + 0xc0]
push str.start
push esi
call fcn.0041d507
add esp, 8
test eax, eax
sete al
test al, al
je 0x40878f
push 1
push 0
push str._start
push edi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea eax, [edi - 0x10]
mov dword [esp + 0x120], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4087b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x118]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0041c1f8
add esp, 0x118
ret
Function at 0x40ae10
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 8]
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40ae3f
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x10]
push eax
push 0
lea ecx, [esp + 0x1c]
push ecx
push 0
push ebp
push edx
call ebx
test eax, eax
je 0x40ae74
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esi + 4]
test eax, eax
push edi
mov edi, dword [esp + 0x14]
je 0x40ae8c
mov ecx, dword [esi]
push eax
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov edx, dword [esi]
push edi
push 0
push edx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x14]
push ecx
push eax
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
push ebp
push eax
mov dword [esi + 8], edi
call ebx
test eax, eax
je 0x40aeef
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call edi
mov edx, dword [esp + 0x24]
push edx
call edi
mov eax, dword [esi + 4]
xor edi, edi
cmp eax, edi
je 0x40aedf
push eax
mov eax, dword [esi]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi + 4], edi
mov dword [esi + 8], edi
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov dword [esi + 0xc], ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
mov eax, dword [esp + 0x24]
push eax
call esi
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret

Function at 0x40af20
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareFastEnter
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40af54
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0xc]
push edi
push edx
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x10]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov esi, eax
call edi
push ebx
call edi
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
add esp, 8
ret
Function at 0x410e1d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x410e60
call fcn.0041507d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x410e60
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x410e7b
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.004109d4
test ebx, ebx
mov esi, eax
je 0x410e79
test edi, edi
je 0x410e79
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4138fc
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x413925
call fcn.0041507d
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x413948
push eax
push dword [esi + 4]
call fcn.00413887
push esi
push eax
mov ecx, 0x442f0c
call fcn.0041353d
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x4142fc
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x4312ae
call fcn.0041db7a
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004142be
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00402050
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 4], eax
jne 0x414362
push eax
push dword [esi + 8]
call fcn.00413887
push dword [esi + 0xc]
mov ecx, 0x442f0c
push eax
call fcn.0041353d
mov eax, esi
call fcn.0041dc19
ret 0x18
Function at 0x416013
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x43fcc0]
xor eax, ebp
mov dword [ebp + 0xdc], eax
cmp dword [ebp + 0xec], 0x800
mov eax, dword [ebp + 0xe8]
push esi
mov dword [ebp - 0x3c], eax
mov esi, ecx
lea eax, [ebp - 0x40]
jne 0x4160ab
push 0x435414
push 4
push eax
call fcn.0041fbab
push eax
call fcn.00401000
add esp, 0x10
push ebx
push edi
call fcn.0041df67
mov edi, dword [eax]
call fcn.0041df67
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.0041e17f
add esp, 0x18
mov dword [ebp - 0x3c], eax
call fcn.0041df67
cmp dword [eax], ebx
je 0x4160c2
call fcn.0041df67
push dword [eax]
call fcn.0040b3b6
pop ecx
jmp 0x4160c9
push 4
push eax
push 3
push dword [ebp + 0xec]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x41605f
jmp 0x41613b
call fcn.0041df67
mov dword [eax], edi
cmp dword [ebp - 0x3c], 0xffffffff
je 0x416137
cmp dword [ebp - 0x3c], esi
jae 0x416137
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.0041dfb0
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x416129
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x416129
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x416129
push ebx
push ebx
push esi
jmp 0x41612f
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x416139
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0xdc]
xor ecx, ebp
pop esi
call fcn.0041c1f8
add ebp, 0xe0
leave
ret
Function at 0x417dc3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x431669
call fcn.0041dbad
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0041507d
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x417e0e
call fcn.0041507d
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x417e1f
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x417e2c
or eax, 0xffffffff
jmp 0x417f88
mov ecx, esi
call fcn.0041790a
mov dword [ebp - 0x14], eax
call fcn.0040e377
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x417eaa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x417eaa
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x417eaa
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0040cf16
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x417eaa
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x417eaa
mov ecx, ebx
call fcn.00412cad
test eax, eax
je 0x417eaa
push 0
mov ecx, ebx
call fcn.00412cc8
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0040fd00
push dword [ebp - 0x14]
call fcn.0040e2cf
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.00417bcb
xor edi, edi
cmp eax, edi
je 0x417f07
test byte [esi + 0x3c], 0x10
je 0x417ef1
push 4
pop edi
mov ecx, esi
call fcn.00412bed
test ax, 0x100
je 0x417ee7
push 5
pop edi
push edi
mov ecx, esi
call fcn.0040de40
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x417f07
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00412d2f
or dword [ebp - 4], 0xffffffff
jmp 0x417f32
cmp dword [ebp - 0x28], edi
je 0x417f40
push 1
mov ecx, ebx
call fcn.00412cc8
cmp dword [ebp - 0x2c], edi
je 0x417f50
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x417f69
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x417f69
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00417944
cmp dword [esi + 0x58], edi
je 0x417f85
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0041dc19
ret
Function at 0x418278
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x418281
xor eax, eax
jmp 0x4182ea
cmp dword [esp + 8], 0
jne 0x41828d
call fcn.0040b1d6
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.00420bd2
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4182c8
push dword [esi + 0x10]
call fcn.004208d8
test eax, eax
pop ecx
jne 0x4182c8
mov esi, dword [esi + 0xc]
call fcn.0041df7a
push esi
push dword [eax]
push 1
call fcn.0041aac5
push dword [esi + 0x10]
call fcn.00420907
test eax, eax
pop ecx
je 0x4182e7
push dword [esi + 0x10]
call fcn.0042082c
push eax
call fcn.00401000
pop ecx
pop ecx
jmp 0x4182b6
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x4182f3
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x4182fd
call fcn.0040b1d6
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.00420d4c
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x41832a
mov esi, dword [esi + 0xc]
call fcn.0041df7a
push esi
push dword [eax]
push 1
call fcn.0041aac5
pop esi
ret 8

Function at 0x41902c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41905a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x419078
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00418f96
jmp 0x419078
mov eax, dword [esi + 0x14]
test eax, eax
je 0x419078
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00418f96
test edi, edi
mov eax, edi
jne 0x419062
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x442f90]
test ecx, ecx
je 0x41913b
jmp 0x41902b
ret 8

Function at 0x41c1f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43fcc0]
jne 0x41c202
repz ret
jmp fcn.00421d88
Function at 0x420936
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x420973
cmp dword [ebp + 0x14], edi
je 0x420973
cmp ecx, edi
jne 0x42097a
call fcn.0041df67
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0041c85f
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x42098e
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x4209af
cmp ebx, 0xffffffff
je 0x42099e
push ebx
push edi
push ecx
call fcn.0041dfb0
add esp, 0xc
cmp esi, edi
je 0x42095b
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x42095b
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x4209cb
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x4209d2
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x420ac3
test word [esi + 0xc], 0x10c
je 0x420a26
mov eax, dword [esi + 4]
test eax, eax
je 0x420a26
jl 0x420b24
cmp ebx, eax
mov edi, ebx
jb 0x4209f7
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x420acb
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.0041cb70
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x420abb
cmp ebx, dword [ebp - 0xc]
jb 0x420a93
cmp dword [ebp - 0xc], 0
je 0x420a50
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x420a45
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x420a4c
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x420a5b
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x420a5b
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x420af7
push eax
push dword [ebp - 8]
push esi
call fcn.0042058b
pop ecx
push eax
call fcn.0042a756
add esp, 0xc
test eax, eax
je 0x420b36
cmp eax, 0xffffffff
je 0x420b24
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x420abb
push esi
call fcn.0042a075
cmp eax, 0xffffffff
pop ecx
je 0x420b28
cmp dword [ebp - 4], 0
je 0x420af7
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x4209da
mov eax, dword [ebp + 0x14]
jmp 0x420975
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x420ae2
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0041dfb0
add esp, 0xc
call fcn.0041df67
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x42096b
cmp dword [ebp + 0xc], 0xffffffff
je 0x420b0d
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0041dfb0
add esp, 0xc
call fcn.0041df67
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x42096b
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x420975
or dword [esi + 0xc], 0x10
jmp 0x420b28
Function at 0x422c13
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x43ff98]
je 0x422c2e
inc edi
cmp edi, 0x17
jb 0x422c1f
cmp edi, 0x17
jae 0x422dae
push ebp
push 3
call fcn.0042bf3e
cmp eax, 1
pop ecx
je 0x422d7a
push 3
call fcn.0042bf3e
test eax, eax
pop ecx
jne 0x422c62
cmp dword [0x43fcbc], 1
je 0x422d7a
cmp ebx, 0xfc
je 0x422dad
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x443740
push ebp
call fcn.0041fbab
add esp, 0xc
test eax, eax
je 0x422c98
push esi
push esi
push esi
push esi
push esi
call fcn.0041c763
add esp, 0x14
push 0x104
mov esi, 0x443759
push esi
push 0
mov byte [0x44385d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x422cdc
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0041fbab
add esp, 0xc
test eax, eax
je 0x422cdc
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041c763
add esp, 0x14
push esi
call fcn.0041dc70
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x422d21
push esi
call fcn.0041dc70
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x443a54
push 0x43627c
sub ecx, eax
push ecx
push eax
call fcn.0041e02a
add esp, 0x14
test eax, eax
je 0x422d21
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041c763
add esp, 0x14
jmp 0x422d23
xor esi, esi
push 0x436278
push ebx
push ebp
call fcn.0041ffb3
add esp, 0xc
test eax, eax
je 0x422d43
push esi
push esi
push esi
push esi
push esi
call fcn.0041c763
add esp, 0x14
push dword [edi*8 + 0x43ff9c]
push ebx
push ebp
call fcn.0041ffb3
add esp, 0xc
test eax, eax
je 0x422d65
push esi
push esi
push esi
push esi
push esi
call fcn.0041c763
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0042bd81
add esp, 0xc
jmp 0x422dad
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x422dad
cmp ebp, 0xffffffff
je 0x422dad
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x43ff9c]
push dword [esi]
call fcn.0041dc70
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x42bd81
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00423237
xor ebx, ebx
cmp dword [0x443cf0], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x42be57
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42bf37
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x436ca0
push edi
call esi
cmp eax, ebx
je 0x42bf37
push eax
call fcn.004231c9
mov dword [esp], 0x436c90
push edi
mov dword [0x443cf0], eax
call esi
push eax
call fcn.004231c9
mov dword [esp], 0x436c7c
push edi
mov dword [0x443cf4], eax
call esi
push eax
call fcn.004231c9
mov dword [0x443cf8], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041fcb9
test eax, eax
pop ecx
pop ecx
je 0x42be25
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041c763
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x42be57
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004231c9
cmp eax, ebx
pop ecx
mov dword [0x443d00], eax
je 0x42be57
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004231c9
pop ecx
mov dword [0x443cfc], eax
mov eax, dword [0x443cfc]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x42bedc
cmp dword [0x443d00], ecx
je 0x42bedc
push eax
call fcn.00423240
push dword [0x443d00]
mov esi, eax
call fcn.00423240
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x42bedc
cmp edi, ebx
je 0x42bedc
call esi
cmp eax, ebx
je 0x42bea9
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42bea9
test byte [ebp - 0x18], 1
jne 0x42bedc
lea eax, [ebp - 0x10]
push eax
call fcn.0041fcf0
test eax, eax
pop ecx
je 0x42bec4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041c763
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x42bed3
or dword [ebp + 0x10], 0x200000
jmp 0x42bf17
or dword [ebp + 0x10], 0x40000
jmp 0x42bf17
mov eax, dword [0x443cf4]
cmp eax, dword [ebp - 8]
je 0x42bf17
push eax
call fcn.00423240
cmp eax, ebx
pop ecx
je 0x42bf17
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x42bf17
mov eax, dword [0x443cf8]
cmp eax, dword [ebp - 8]
je 0x42bf17
push eax
call fcn.00423240
cmp eax, ebx
pop ecx
je 0x42bf17
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x443cf0]
call fcn.00423240
cmp eax, ebx
pop ecx
je 0x42bf37
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42bf39
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430a66
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x43fcc0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004309fb
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041dfb0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x430ab5
cmp dword [ebp - 0x1c], 5
jb 0x430acd
jmp 0x430ac9
cmp dword [ebp - 0x10], 1
jne 0x430acd
cmp dword [ebp - 0x1c], 4
ja 0x430ac9
jne 0x430acd
cmp dword [ebp - 0x18], 0
jbe 0x430acd
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x43769c
call fcn.004308cf
test eax, eax
jge 0x430aee
mov byte [0x443e44], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041c1f8
add ebp, 0x78
leave
ret
Function at 0x404042
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x404089
cmp ebx, 0x20
je 0x404089
cmp ebx, 0xffffffe0
je 0x404089
jne 0x404092
add eax, 1
cmp esi, eax
je 0x40409f
jne 0x40406e
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x4040a3
jne 0x40406a
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x467452
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov ebx, dword [ebp + 8]
cmp ebx, 0
je 0x467497
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x46749d
add eax, 4
pop esi
dec esi
push esi
jne 0x46747f
xor eax, eax
leave
ret 8
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
leave
ret 8