joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403380
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x180c
call fcn.0040c0e0
mov eax, dword [0x2b89b5c]
mov ecx, dword [0x2b89ad0]
push ebx
push ebp
shr eax, 3
push esi
push edi
test eax, eax
jbe 0x40348b
mov edi, dword [sym.imp.KERNEL32.dll_SetHandleCount]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionA]
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
cmp dword [0x2b89b5c], 0x959
jne 0x403471
push 0
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExA]
push 0
push 0
lea ecx, [esp + 0x820]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea edx, [esp + 0x101c]
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
push 0x402ce8
push 0x402d14
call esi
push 0
push 0x402d4c
push 0x402d60
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.004031c0
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x4033c4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x180c
ret
Function at 0x408f20
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42fa40]
jne 0x408f2a
repz ret
jmp fcn.0040ae8c

Function at 0x40a3a7
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405b5a
and dword [ebp - 4], 0
cmp dword [0x432d2c], 0
mov ebx, eax
jne 0x40a458
push 0x402bdc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a509
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x402bd0
push edi
call esi
test eax, eax
je 0x40a509
push eax
call fcn.00405ae8
mov dword [esp], 0x402bc0
push edi
mov dword [0x432d2c], eax
call esi
push eax
call fcn.00405ae8
mov dword [esp], 0x402bac
push edi
mov dword [0x432d30], eax
call esi
push eax
call fcn.00405ae8
mov dword [esp], 0x402b90
push edi
mov dword [0x432d34], eax
call esi
push eax
call fcn.00405ae8
pop ecx
mov dword [0x432d3c], eax
test eax, eax
je 0x40a458
push 0x402b78
push edi
call esi
push eax
call fcn.00405ae8
pop ecx
mov dword [0x432d38], eax
mov eax, dword [0x432d38]
cmp eax, ebx
je 0x40a4b0
cmp dword [0x432d3c], ebx
je 0x40a4b0
push eax
call fcn.00405b63
push dword [0x432d3c]
mov esi, eax
call fcn.00405b63
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a4b0
test edi, edi
je 0x40a4b0
call esi
test eax, eax
je 0x40a4a7
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a4a7
test byte [ebp - 0xc], 1
jne 0x40a4b0
or dword [ebp + 0x10], 0x200000
jmp 0x40a4e9
mov eax, dword [0x432d30]
cmp eax, ebx
je 0x40a4e9
push eax
call fcn.00405b63
pop ecx
test eax, eax
je 0x40a4e9
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a4e9
mov eax, dword [0x432d34]
cmp eax, ebx
je 0x40a4e9
push eax
call fcn.00405b63
pop ecx
test eax, eax
je 0x40a4e9
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x432d2c]
call fcn.00405b63
pop ecx
test eax, eax
je 0x40a509
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a50b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401cb0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x401e0f
push eax
mov dword fs:[0], esp
sub esp, 4
push ebx
push esi
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0x4330c0
push edi
mov esi, ecx
xor edi, edi
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [esi + 4], edi
mov eax, dword [ebp + 0x10]
mov dword [esi + 8], edi
mov dword [ebp - 4], edi
mov dword [esi], 0x4330bc
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], edx
mov dword [esi + 0x48], eax
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x14], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], eax
mov ebx, dword [ebp + 0x1c]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x30], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], edi
mov dword [esi + 0x64], edi
mov dword [esi + 0x6c], edi
mov dword [esi + 0x58], edi
sub ecx, 4
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x4c], edi
mov dword [esi + 0x68], 0x100
cmp ecx, 3
ja case.default.0x401d5a
jmp dword [ecx*4 + 0x401e24]
test edx, edx
jle 0x401da1
fld dword [ebp + 0x14]
fmul dword [0x432f4c]
fld dword [ebp + 0x18]
fmul dword [0x432f54]
fxch st(1)
fadd dword [0x432f50]
fxch st(1)
fadd dword [0x432f58]
mov dword [esi + 0x34], 0x521cb8
fxch st(1)
fstp dword [esi + 0xc]
fstp dword [esi + 0x10]
mov dword [esi + 0x44], 0
dec edx
mov dword [esi + 0x38], edx
mov eax, dword [0x437190]
mov dword [esi + 0x60], eax
jmp case.default.0x401d5a
mov eax, dword [0x437190]
mov dword [esi + 0x6c], eax
call fcn.004203b0
cdq
xor eax, edx
mov ecx, dword [esi + 0x44]
sub eax, edx
and eax, 0x7f
xor eax, edx
sub eax, edx
add eax, 0x7f
test ecx, ecx
mov dword [esi + 0x60], eax
jne case.default.0x401d5a
mov dword [esi + 0x44], 0x190
jmp case.default.0x401d5a
mov dword [esi + 0x48], 0
mov eax, dword [0x437190]
mov dword [esi + 0x60], eax
jmp case.default.0x401d5a
mov eax, dword [0x437190]
mov dword [esi + 0x6c], eax
mov eax, esi
pop edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4128d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
mov ebx, dword [esp + 0x20]
push ebp
mov ebp, dword [esp + 0x28]
mov eax, dword [esi + 0xc]
mov dword [esi + 0xcfc], ebx
mov dword [esi + 0xd00], ebp
test eax, eax
jne 0x412a6d
mov eax, dword [esi + 0x40]
test eax, eax
je 0x412a6d
push 1
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call edi
mov dword [esp + 0x18], ebx
push 0
lea eax, [esp + 0x14]
push 0
mov dword [esp + 0x24], ebp
push 0xcf0000
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
push eax
call dword [sym.imp.USER32.dll_AdjustWindowRectEx]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
sub eax, ecx
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov dword [esi + 0xd04], eax
sub ebp, edx
mov eax, dword [esi + 0xd7c]
mov dword [esi + 0xd08], ebp
test eax, eax
je 0x4129f4
push 1
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
call ebx
sub eax, ebp
push 0
cdq
sub eax, edx
sar eax, 1
mov ebp, eax
call ebx
sub eax, dword [esi + 0xd04]
cdq
sub eax, edx
sar eax, 1
test eax, eax
jg 0x412990
xor eax, eax
mov dword [esi + 0xcf4], eax
test ebp, ebp
jg 0x41299c
xor ebp, ebp
mov eax, dword [esi + 0xc]
mov dword [esi + 0xcf8], ebp
test eax, eax
jne 0x412a5e
mov eax, dword [esi + 0x40]
test eax, eax
je 0x412a5e
push 1
push eax
call edi
push 1
mov eax, dword [esi + 0xd08]
push eax
mov ecx, dword [esi + 0xd04]
push ecx
mov edx, dword [esi + 0xcf8]
push edx
mov eax, dword [esi + 0xcf4]
push eax
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
lea eax, [esp + 0x10]
mov ecx, dword [esi + 0x40]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x412a0d
xor eax, eax
mov dword [esi + 0xcf4], eax
mov eax, dword [esp + 0x14]
test eax, eax
jg 0x412a1d
xor eax, eax
mov dword [esi + 0xcf8], eax
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x412a5e
mov eax, dword [esi + 0x40]
test eax, eax
je 0x412a5e
push 1
push eax
call edi
push 1
mov eax, dword [esi + 0xd08]
push eax
mov ecx, dword [esi + 0xd04]
push ecx
mov edx, dword [esi + 0xcf8]
push edx
mov eax, dword [esi + 0xcf4]
push eax
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x413230
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov eax, dword [ecx + 0x40]
push edi
mov esi, ecx
push 0xcf0000
push 0xfffffffffffffff0
mov edi, dword [sym.imp.USER32.dll_SetWindowLongA]
push eax
call edi
push 0
mov ecx, dword [esi + 0x40]
push 0xffffffffffffffec
push ecx
call edi
push 1
mov eax, dword [esi + 0x40]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x40]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [esi + 0xd00]
mov edx, dword [esi + 0xcfc]
push ecx
push edx
mov ecx, esi
call fcn.004128d0
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push edi
push ecx
mov edx, dword [esi + 0x40]
push eax
lea ecx, [esi + 0x44]
push edx
call fcn.004159a0
cmp edi, 8
jne 0x4132b0
push 0
lea ecx, [esi + 0xca8]
push 0
push 0
push 8
call fcn.00411fa0
cmp edi, 0x10
jne 0x4132ce
push 0x1f
lea ecx, [esi + 0xca8]
push 0x3e0
push 0x7c00
push 0x10
call fcn.00411fa0
cmp edi, 0x18
je 0x4132d8
cmp edi, 0x20
jne 0x4132f3
push 0xff
lea ecx, [esi + 0xca8]
push 0xff00
push 0xff0000
push edi
call fcn.00411fa0
mov eax, 1
pop edi
pop esi
pop ebx
ret 0xc
Function at 0x414d00
Capabilities:
Set registry value

Disassembly:
sub esp, 4
push ebx
push esi
push edi
mov ebx, ecx
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x414db4
mov eax, dword [ebx + 0x400]
lea esi, [ebx + 0x400]
test eax, eax
je 0x414d3a
push eax
mov edi, dword [0x5df314]
call edi
test eax, eax
jne 0x414d40
mov dword [esi], 0
jmp 0x414d40
mov edi, dword [0x5df314]
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 0xf003f
push 0
push 0
push 0
push ebx
push 0x80000001
call dword [0x5df318]
test eax, eax
jne 0x414dac
lea eax, [esp + 0x1c]
push 4
push eax
mov ecx, dword [esi]
push 4
push 0
push ebp
push ecx
mov ebp, dword [0x5df310]
call ebp
test eax, eax
jne 0x414dba
mov eax, dword [esi]
test eax, eax
je 0x414da0
push eax
call edi
test eax, eax
jne 0x414da0
mov eax, 1
pop ebp
pop edi
mov dword [esi], 0
pop esi
pop ebx
add esp, 4
ret 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8
mov dword [esi], 0
jmp 0x414dba
mov edi, dword [0x5df314]
mov eax, dword [ebx + 0x400]
test eax, eax
je 0x414dd5
push eax
call edi
test eax, eax
jne 0x414dd5
mov dword [ebx + 0x400], 0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 8

Function at 0x414df0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, 4
mov dword [esp], eax
push ebx
mov dword [esp + 8], eax
push esi
push edi
mov esi, ecx
push ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x414ec1
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x414ec1
mov eax, dword [esi + 0x400]
lea edi, [esi + 0x400]
test eax, eax
je 0x414e3f
push eax
call dword [0x5df314]
test eax, eax
jne 0x414e3f
mov dword [edi], 0
lea eax, [esp + 0x1c]
push eax
push edi
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push 0x80000001
call dword [0x5df318]
test eax, eax
jne 0x414ebb
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push eax
push ecx
mov eax, dword [edi]
push edx
push 0
push ebp
push eax
mov ebp, dword [0x5df30c]
call ebp
test eax, eax
jne 0x414ec1
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
mov eax, dword [edi]
test eax, eax
je 0x414eaf
push eax
call dword [0x5df314]
test eax, eax
jne 0x414eaf
mov eax, 1
pop ebp
mov dword [edi], 0
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
mov dword [edi], 0
mov eax, dword [esi + 0x400]
test eax, eax
je 0x414ee0
push eax
call dword [0x5df314]
test eax, eax
jne 0x414ee0
mov dword [esi + 0x400], 0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
Function at 0x414f40
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x24
push ebx
push esi
push edi
mov esi, ecx
push ebp
call fcn.004150e0
mov ebp, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
cmp ebp, edi
jg 0x414f5c
mov ebp, edi
mov eax, dword [esp + 0x3c]
mov dword [esi], 0xffff
mov word [esi + 6], ax
test eax, eax
mov word [esi + 4], 0x100
jg 0x414f7a
mov word [esi + 6], 0xac44
mov eax, dword [esp + 0x38]
test eax, eax
je 0x414fad
xor ebx, ebx
call sub.audiow32.dll_Ordinal_102
test eax, eax
je 0x414fad
lea eax, [esp + 0x10]
push eax
push ebx
call sub.audiow32.dll_Ordinal_103
cmp word [esp + 0x10], 0x100
jne 0x414fa3
mov dword [esi], ebx
inc ebx
call sub.audiow32.dll_Ordinal_102
cmp eax, ebx
ja 0x414f8d
push esi
call sub.audiow32.dll_Ordinal_106
test eax, eax
jne 0x4150cb
mov dword [esi + 0x28], 1
mov ebx, dword [esp + 0x40]
test ebx, ebx
jle 0x415009
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x415009
push 0x433104
lea eax, [ebx*4]
push eax
call fcn.00418330
add esp, 8
mov dword [esi + 0x20], eax
test eax, eax
je 0x415009
test ebx, ebx
jle 0x415006
xor ecx, ecx
mov eax, ebx
mov edx, dword [esi + 0x20]
add ecx, 4
dec eax
mov dword [edx + ecx - 4], 0
jne 0x414ff5
mov dword [esi + 0xc], ebx
xor ebx, ebx
test ebp, ebp
jle 0x4150cb
test edi, edi
jle 0x4150cb
mov eax, dword [esi + 0x24]
cmp eax, ebx
jne 0x4150cb
push 0x433104
lea eax, [edi*4]
push eax
call fcn.00418330
add esp, 8
mov dword [esi + 0x24], eax
test eax, eax
je 0x4150cb
push ebp
mov dword [esi + 0x18], ebp
mov dword [esi + 0x14], edi
call sub.audiow32.dll_Ordinal_109
test eax, eax
jne 0x4150cb
xor edi, edi
mov eax, dword [esi + 0x14]
cmp eax, ebx
jle 0x415073
mov eax, dword [esi + 0x24]
inc edi
add eax, ebx
add ebx, 4
push eax
call sub.audiow32.dll_Ordinal_118
cmp dword [esi + 0x14], edi
jg 0x41505f
mov ebx, dword [esp + 0x44]
test ebx, ebx
jle 0x4150cb
mov eax, dword [esi + 0x1c]
test eax, eax
jne 0x4150cb
push 0x433104
lea eax, [ebx*8]
push eax
call fcn.00418330
add esp, 8
mov edi, eax
mov dword [esi + 0x1c], eax
test edi, edi
je 0x4150cb
lea ecx, [ebx*8]
xor eax, eax
shr ecx, 2
push str.SEAL_Initialized._n
rep stosd dword es:[edi], eax
mov dword [esi + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x18
mov ecx, esi
call fcn.004150e0
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x24
ret 0x18
Function at 0x415200
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x3e8
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ecx + 0x20]
test ecx, ecx
je 0x4152b9
mov esi, dword [esp + 0x400]
test esi, esi
jl 0x4152b9
mov eax, dword [edi + 0xc]
cmp esi, eax
jge 0x4152b9
test ecx, ecx
je 0x415253
test esi, esi
jl 0x415253
cmp esi, eax
jge 0x415253
mov eax, dword [ecx + esi*4]
test eax, eax
je 0x415253
push eax
call sub.audiow32.dll_Ordinal_143
mov eax, dword [edi + 0x20]
mov dword [eax + esi*4], 0
shl esi, 2
mov eax, dword [esp + 0x3fc]
mov ecx, dword [esp + 0x3f8]
push eax
mov eax, dword [edi + 0x20]
add eax, esi
push eax
push ecx
call sub.audiow32.dll_Ordinal_142
test eax, eax
mov eax, dword [edi + 0x20]
jne 0x4152b2
mov edx, dword [eax + esi]
xor ecx, ecx
mov cx, word [edx + 0x24]
lea eax, [esp + 0xc]
push ecx
push str.nRestart_is__d_n
push eax
call fcn.00421420
lea ecx, [esp + 0x18]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [edi + 0x20]
mov eax, dword [ecx + esi]
mov word [eax + 0x24], 0
mov eax, 1
jmp 0x4152bb
mov dword [eax + esi], 0
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x3e8
ret 0xc
Function at 0x41d330
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d415
push eax
mov dword fs:[0], esp
sub esp, 8
mov dword [ebp - 0x14], ecx
push esi
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 0x14]
lea eax, [ecx - 1]
cmp eax, 1
sbb eax, eax
neg eax
mov dword [edx + 0x38], eax
test ecx, ecx
jne 0x41d3a3
mov esi, edx
add esi, 0x3c
je 0x41d399
call fcn.0041f9a0
mov dword [esi], eax
mov ecx, dword [0x438158]
mov dword [ebp - 4], 0
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
jae 0x41d38d
inc eax
mov dword [ecx + 4], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0041d41f
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x4c], 0
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [edx + 0x48], eax
mov ecx, dword [0x5dd9f8]
lea eax, [edx + 4]
mov dword [edx + 0x40], ecx
mov ecx, dword [0x5dd9f8]
lea esi, [edx + 8]
mov dword [edx + 0x44], ecx
xor ecx, ecx
mov dword [edx + 0xc], eax
lea eax, [edx + 0x14]
mov dword [edx + 0x50], ecx
mov dword [edx + 0x54], ecx
mov dword [edx + 0x10], esi
mov dword [edx + 0x1c], eax
lea eax, [edx + 0x18]
mov dword [edx + 0x20], eax
lea eax, [edx + 0x24]
mov dword [edx + 0x2c], eax
lea eax, [edx + 0x28]
mov dword [edx + 0x30], eax
mov dword [esi], ecx
mov eax, dword [edx + 0x20]
mov dword [eax], ecx
mov esi, dword [edx + 0x30]
mov dword [esi], ecx
mov eax, dword [edx + 0xc]
mov dword [eax], ecx
mov esi, dword [edx + 0x1c]
mov dword [esi], ecx
pop esi
mov eax, dword [edx + 0x2c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov dword fs:[0], eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4218d0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4334d0
push 0x4245c8
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x438504], eax
xor eax, eax
mov al, byte [0x438505]
mov dword [0x438510], eax
mov eax, dword [0x438504]
shr dword [0x438504], 0x10
and eax, 0xff
mov dword [0x43850c], eax
shl eax, 8
add eax, dword [0x438510]
mov dword [0x438508], eax
call fcn.00425510
test eax, eax
jne 0x421944
push 0x1c
call fcn.00421a70
add esp, 4
mov dword [ebp - 4], 0
call fcn.00426cd0
call fcn.004287c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x5deb34], eax
call fcn.00428370
mov dword [0x438240], eax
test eax, eax
je 0x421977
cmp dword [0x5deb34], 0
jne 0x421981
push 0xffffffffffffffff
call fcn.00422600
add esp, 4
call fcn.004280f0
call fcn.00428000
call fcn.004225d0
mov esi, dword [0x5deb34]
mov al, byte [esi]
cmp al, 0x22
je 0x4219a8
cmp al, 0x20
jbe 0x4219d5
inc esi
cmp byte [esi], 0x20
ja 0x4219a0
jmp 0x4219d5
inc esi
cmp byte [esi], 0x22
je 0x4219d4
mov bl, byte [ebp - 0x28]
mov bl, byte [esi]
test bl, bl
je 0x4219cf
xor eax, eax
mov al, bl
push eax
call fcn.00427fa0
add esp, 4
test eax, eax
je 0x4219c9
inc esi
inc esi
cmp byte [esi], 0x22
jne 0x4219b1
cmp byte [esi], 0x22
jne 0x4219d5
inc esi
cmp byte [esi], 0
je 0x4219e5
cmp byte [esi], 0x20
ja 0x4219e5
inc esi
cmp byte [esi], 0
jne 0x4219da
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x44], 1
mov eax, 0xa
je 0x421a09
mov eax, dword [ebp - 0x40]
and eax, 0xffff
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00422600
jmp 0x421a4a
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422640
Capabilities:
Terminate process

Disassembly:
cmp dword [0x438540], 1
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
jne 0x42265e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x43853c], 1
cmp dword [esp + 0x14], 0
mov ebx, dword [esp + 0x18]
mov byte [0x438538], bl
jne 0x4226b8
cmp dword [0x5ddb1c], 0
je 0x4226a6
mov edi, dword [0x5ddb18]
sub edi, 4
cmp edi, dword [0x5ddb1c]
jb 0x4226a6
mov eax, dword [edi]
test eax, eax
je 0x42269b
call eax
sub edi, 4
cmp edi, dword [0x5ddb1c]
jae 0x422693
push 0x437108
push 0x437100
call fcn.004226f0
add esp, 8
push 0x437110
push 0x43710c
call fcn.004226f0
add esp, 8
test ebx, ebx
jne 0x4226df
mov dword [0x438540], 1
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
ret
Function at 0x424d70
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x5ddb10], edx
push ebx
push esi
push edi
push ebp
jbe 0x424f77
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x5dda10
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x424f77
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x424dd9
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x424dea
push 2
push 0
push edx
call fcn.00426c10
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x424e86
mov dword [esp + 0x10], 0
mov ebx, dword [esp + 0x430]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x424ebf
lea edi, [esp + 0x24]
mov eax, ebx
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x424e4d
mov al, byte [ebx]
inc ebx
cmp al, 0xa
jne 0x424e3b
mov byte [edi], 0xd
inc esi
inc edi
mov byte [edi], al
inc edi
mov eax, edi
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x424e22
lea eax, [esp + 0x24]
push 0
sub edi, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push edi
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424eb5
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, edi
jge 0x424e0d
jmp 0x424ebf
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x424eb5
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x424ebf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x424f66
cmp dword [esp + 0x10], 0
je 0x424f18
cmp dword [esp + 0x10], 5
jne 0x424efb
mov dword [0x4384f8], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x4384fc], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.00429c70
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x424f42
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x424f42
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4384f8], 0x1c
mov dword [0x4384fc], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x4384f8], 9
mov dword [0x4384fc], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret