joyce8/EMBER2024-capa huggingface dataset:
Function at 0x432d75
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x469ad0]
je 0x432d90
inc edi
cmp edi, 0x17
jb 0x432d81
cmp edi, 0x17
jae 0x432f10
push ebp
push 3
call fcn.0043d823
cmp eax, 1
pop ecx
je 0x432edc
push 3
call fcn.0043d823
test eax, eax
pop ecx
jne 0x432dc4
cmp dword [0x469904], 1
je 0x432edc
cmp ebx, 0xfc
je 0x432f0f
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x46d438
push ebp
call fcn.0043b9d2
add esp, 0xc
test eax, eax
je 0x432dfa
push esi
push esi
push esi
push esi
push esi
call fcn.004315c8
add esp, 0x14
push 0x104
mov esi, 0x46d451
push esi
push 0
mov byte [0x46d555], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x432e3e
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0043b9d2
add esp, 0xc
test eax, eax
je 0x432e3e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.004315c8
add esp, 0x14
push esi
call fcn.004306d0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x432e83
push esi
call fcn.004306d0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x46d74c
push 0x45777c
sub ecx, eax
push ecx
push eax
call fcn.0043d770
add esp, 0x14
test eax, eax
je 0x432e83
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.004315c8
add esp, 0x14
jmp 0x432e85
xor esi, esi
push 0x457778
push ebx
push ebp
call fcn.0043d6ff
add esp, 0xc
test eax, eax
je 0x432ea5
push esi
push esi
push esi
push esi
push esi
call fcn.004315c8
add esp, 0x14
push dword [edi*8 + 0x469ad4]
push ebx
push ebp
call fcn.0043d6ff
add esp, 0xc
test eax, eax
je 0x432ec7
push esi
push esi
push esi
push esi
push esi
call fcn.004315c8
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043d542
add esp, 0xc
jmp 0x432f0f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x432f0f
cmp ebp, 0xffffffff
je 0x432f0f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x469ad4]
push dword [esi]
call fcn.004306d0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43d542
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00433939
xor ebx, ebx
cmp dword [0x46df40], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43d618
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43d6f8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43d6f8
push eax
call fcn.004338cb
mov dword [esp], 0x457bb4
push edi
mov dword [0x46df40], eax
call esi
push eax
call fcn.004338cb
mov dword [esp], 0x457ba0
push edi
mov dword [0x46df44], eax
call esi
push eax
call fcn.004338cb
mov dword [0x46df48], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00432696
test eax, eax
pop ecx
pop ecx
je 0x43d5e6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004315c8
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43d618
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004338cb
cmp eax, ebx
pop ecx
mov dword [0x46df50], eax
je 0x43d618
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004338cb
pop ecx
mov dword [0x46df4c], eax
mov eax, dword [0x46df4c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43d69d
cmp dword [0x46df50], ecx
je 0x43d69d
push eax
call fcn.00433942
push dword [0x46df50]
mov esi, eax
call fcn.00433942
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43d69d
cmp edi, ebx
je 0x43d69d
call esi
cmp eax, ebx
je 0x43d66a
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43d66a
test byte [ebp - 0x18], 1
jne 0x43d69d
lea eax, [ebp - 0x10]
push eax
call fcn.004326cd
test eax, eax
pop ecx
je 0x43d685
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004315c8
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43d694
or dword [ebp + 0x10], 0x200000
jmp 0x43d6d8
or dword [ebp + 0x10], 0x40000
jmp 0x43d6d8
mov eax, dword [0x46df44]
cmp eax, dword [ebp - 8]
je 0x43d6d8
push eax
call fcn.00433942
cmp eax, ebx
pop ecx
je 0x43d6d8
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43d6d8
mov eax, dword [0x46df48]
cmp eax, dword [ebp - 8]
je 0x43d6d8
push eax
call fcn.00433942
cmp eax, ebx
pop ecx
je 0x43d6d8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46df40]
call fcn.00433942
cmp eax, ebx
pop ecx
je 0x43d6f8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43d6fa
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x446017
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x46e0fc], 0
push esi
jne 0x445f8a
call fcn.00445eb5
test eax, eax
je 0x445fcd
mov eax, dword [0x46e0fc]
cmp eax, 1
jne 0x445fab
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x445fcd
pop esi
ret
push eax
call dword [0x46e104]
test eax, eax
jne 0x446015
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x445fd1
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x46e0fc]
call dword [0x46e104]
mov edi, eax
test edi, edi
je 0x445ff8
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x446014
lea edi, [esi + 0xff0]
push esi
push dword [0x46e0fc]
call dword [0x46e100]
add esi, 0x10
cmp esi, edi
jb 0x445ffe
mov eax, esi
pop edi
pop esi
ret
jmp 0x445f77

Function at 0x446168
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x469930]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004460fd
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0042d110
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4461b7
cmp dword [ebp - 0x1c], 5
jb 0x4461cf
jmp 0x4461cb
cmp dword [ebp - 0x10], 1
jne 0x4461cf
cmp dword [ebp - 0x1c], 4
ja 0x4461cb
jne 0x4461cf
cmp dword [ebp - 0x18], 0
jbe 0x4461cf
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x459580
call fcn.00403716
test eax, eax
jge 0x4461f0
mov byte [0x46e1cc], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0042d9aa
add ebp, 0x78
leave
ret
Function at 0x403d40
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 8], 0
push ebp
mov ebp, dword [esp + 8]
push edi
je 0x403da9
xor edi, edi
test ebx, ebx
jbe 0x403d6e
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x403d7c
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov al, byte [ecx + edx]
mov byte [edi + ebp], al
inc dword [esi + 0xc]
inc edi
cmp edi, ebx
jb 0x403d52
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop ebp
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x10000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x403d6e
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x403d5a
push esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040e190
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
jmp 0x403d4c

Function at 0x4090c0
Capabilities:
Encode data using xor

Disassembly:
sub dword [esp + ebx + 0x5655288b], 0xffffff8b
jp 0x40903e
mov bl, 0xed
mov dword [esp + eax + 0x14], 0x487630
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
add al, 0x14
xor byte [esi + 0x48], dh
add byte [ecx - 0x76e7db94], cl
insb byte es:[edi], dx
and al, 0x1c
mov dword [esp + 0x21], ebp
mov ecx, dword [esi + ecx*4]
mov esi, dword [ecx]
movsx ecx, word [ecx + 0xa]
push edi
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x10]
push ecx
inc edx
inc ebx
lea ebx, [esp + 0x24]
call fcn.00409110
test eax, eax
or eax, 0x23e4285
add byte [esi - 0x73], dl
mov ebx, 0x8057c
push edi
call 0x2045e0
mov edx, dword [esp + 0x10]
aas
push eax
sbb cl, byte [edi]
mov word [ecx], ds
push ds
add al, byte [eax]
push esi
push edi
call fcn.004045e0
mov ecx, dword [esp + 0x54]
cmp ecx, dword [eax + 0x1c]
jg 0x1042cea9
stosd dword es:[edi], eax
push esp
and al, 0xc
push edx
mov dword [esp + 0x1c], eax
push eax
pop esi
mov ecx, ebx
call 0x184160
test eax, esp
jne 0x42ceb6
mov dword [esp + 0x1c], 0x42487630
cmp dword [esp + 0x20], ebp
push esi
and al, 0x33
dec dword [ebx + 0x244d8bff]
mov ecx, dword [ebp + 0x24]
sbb al, 0x8a
xor al, 0xb9
cmp esi, ebp
je 0x4090e9
call fcn.004092c1
push esi
call fcn.004112ef
mov eax, esp
add al, 0x67
cmp edi, dword [esp + 0x20]
jb 0x4090d0
cmp edi, dword [si + 0x24]
and byte [edx - 0x20], dh
mov edx, dword [esp + 0x14]
push edx
mov dword [esp + 0x25], ebp
call 0x404512ef
add dword [esp + eax + 0x5e5fc033], 0x5d
pop edi
pop esi
pop ebp
xchg edx, eax
invalid
lea ecx, [esp + 0x18]
call fcn.00410ae0
mov eax, 1
jmp 0x409103
Function at 0x409340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
je 0x40939c
push edi
mov edi, eax
mov eax, dword [edi + 0x14]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [eax], edx
mov ebp, dword [eax + 0xc]
mov ecx, dword [eax + 4]
adc dword [esi + 0x24], 0xc508b58
inc dword [ebp + 0x28]
inc dword [esp + 0x10]
cmp esi, esi
mov dword [esp + 0x1c], ecx
mov dword [eax + 0x24], edx
and byte [ecx + 0x7924246c], bh
pop ebp
cld
js 0x4093c9
add byte [edi], cl
test ecx, edi
add al, byte [bx + si]
push 0xa7ccc
lea edx, [esi + 0x24]
sbb al, 0x12
call 0xfd4042f0
xchg esp, eax
ror byte [edi], 0x84
sti
add byte [eax], al
add byte [ecx + 0x44a7ccc], ah
cmp eax, dword [ebx + 0xee840f]
add byte [eax], al
mov esi, dword [eax + 0x10]
mov eax, dword [eax + 0x14]
and esi, 0xff00
mov dword [esp + 0x14], ecx
cmp ebx, eax
iretd
test eax, eax
add eax, dword [bx + si]
wait
ja 0x4093d5
mov ecx, dword [esp + 0x10]
mov esi, dword [esi + ecx*4]
cmp word [esi], 8
dec esi
je 0x442fbd5
stosd dword es:[edi], eax
ror byte [ebx + 0x48b0446], 1
mov byte [edi], cl
mov bh, 0x48
or dword [esi - 0x79], esp
clc
lodsd eax, dword [esi]
je 0x42fc7b
cmp dword [edx + 0x28], 9
je 0x842fcc8
invalid
add cl, byte [eax]
mov edx, dword [edi + 4]
mov eax, dword [edx + ecx*4]
movsx edx, word [eax + 0x48]
cmp esi, 0x41
jne 0x4094f5
push 0xffffffffffffffff
lea edx, [esp - 0x54]
push edx
push eax
lea eax, [esi + 0x18]
push edx
mov dword [esp + 0x1e], ecx
mov ecx, dword [esp + 0x48]
push edi
mov dword [esp + 0x38], ebx
mov dword [esp + 0x40], 1
mov dword [esp + ebp + 0x44], ebx
jmp fcn.0040ab50
pop edi
pop esi
pop ebp
pop ebx
wait
int3
cmp esi, 0x52
je 0x409416
in eax, dx
adc ch, byte [eax + 2]
add byte [ebx - 0x17c533a], dl
adc al, 0xf
cmpsd dword [esi], dword es:[edi]
insb byte es:[edi], dx
invalid
cmp dword [edx + 8], 8
je 0x42fcc8
mov esi, dword [esp + 0x3c]
push 1
push str.Variable_must_be_of_type_Object.
push ebx
push 0xa9
push esi
call fcn.004781ae
test eax, eax
je 0x42fcba
mov ecx, dword [edi + 4]
mov edx, dword [esp + 0x10]
mov eax, dword [ecx + edx*4]
movsx ecx, word [eax + 0xa]
push ecx
push 0xa9
push esi
call fcn.0045e62e
lea ecx, [esp + 0x18]
call fcn.00402620
jmp 0x40948e
cmp ax, 0x35
je 0x42fcd8
cmp ax, 0x47
jne 0x409403
mov esi, dword [esp + 0x3c]
push edx
lea edx, [esp + 0x14]
push edx
push edi
push esi
call fcn.0047f2b4
test eax, eax
je 0x42fd07
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + ecx*4]
movsx eax, word [edx + 0xa]
push eax
push 0xaa
push esi
call fcn.0045e62e
lea ecx, [esp + 0x18]
call fcn.00402620
jmp 0x40948e
Function at 0x40f110
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
lea eax, [esp]
push eax
xor edx, edx
push 1
push edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov word [esi], dx
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f15f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret

Function at 0x40f6a0
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.004131f0
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x4103e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4972c8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x4972c8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x4972c0], eax
call esi
mov edx, dword [0x4972c0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x4972bc], eax
call esi
mov eax, dword [0x4972c0]
push 0
push eax
call esi
pop esi
ret

Function at 0x410c80
Capabilities:
Query or enumerate registry value

Disassembly:
test byte [esp + eax*2], ah
add al, byte [eax]
add byte [eax - 0x73], dl
mov word [esp + edx*2], fs
add al, 0
add byte [ecx - 0x73], dl
push esp
and al, 0x40

Function at 0x4122a5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esp
adc bh, bl
mov esi, edx
test esi, esi
jne 0x412031
push cs
mov dh, 0x70
test byte [edi], 0xb6
push ecx
mul byte [ebx]
xor al, 0x15
xor edx, edx
test dl, ah
setg dl
lea edx, [edx + edx - 9]
mov esi, edx
test edi, edi
jno 0x412031
movzx esi, byte [eax - 9]
movzx edx, byte [ecx - 0xd]
sub esi, edx
je 0x4122f0
jae 0x4122b3
test dword [esi - 0x723d60f2], esi
push esp
adc bh, bh
mov esi, edx
jmp 0x4122f0
test dword [esi - 0x2c67ab1], esi
invalid

Function at 0x4137e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [ebp + 0xc]
test ecx, 0x800003
je 0x413818
mov al, byte [ecx]
add ecx, 0x11
test al, al
xor al, 0xe
cmc
rol dword [ebx], 0
adc dword [eax], eax
jne 0x4137ec
add eax, 0x10
lea esp, [esp + 0x2800000]
lea esp, [esp + 0x18]
mov eax, dword [ecx]
mov dl, 0xff
imul dh
jle 0x413823
rol byte [ebx - 0x1dcc2020], 0xcb
rol dword [ecx + edi*4], 0
add eax, dword [ecx]
xor dword [eax + ebp*8 - 0x75], 0xc184fc41
xor al, 0x32
test ah, ah
and al, 0xa9
add byte [eax], al
inc dword [eax]
je 0x41384d
test eax, 0xff000010
je 0x41384b
jmp 0x413810
rol ebx, 0x8d
inc ecx
dec byte [ebx + 0x2b05244c]
enter 0xffffffffffff8dc3, 0x41
std
mov ecx, dword [esp + 4]
sub eax, ecx
ret
lea eax, [ecx - 2]
mov ecx, dword [esp + 5]
sub ecx, eax
ret
Function at 0x41420e
Capabilities:
Create thread

Disassembly:
pop ecx
cmp esi, edx
je 0x4141f2
test al, 0xc5
sub al, byte [eax]
add bh, bl
jo 0x41421c
push esi
call fcn.00416b12
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x58], eax
mov eax, dword [0x9949591c]
jbe 0x41421c
cmp eax, ebx
jne 0x4141cf
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push edi
js 0x4141b1
inc eax
push ecx
add bh, bh
jne 0x4141e8
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x414209
and bh, bh
add eax, sym.imp.KERNEL32.dll_GetLastError
inc dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
push esi
call 0x3d3a88
pop eax
cmp dword [edi - 0xc], ebx
je 0x414207
or ebp, edi
std
jne 0x4141fd
call fcn.00417f49
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
leave
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
jle 0x4141a3
push ebp
or al, 0xeb
pop es
cmp cl, dl
je 0x414232
inc eax
inc eax
movzx ebp, word [eax]
xchg cx, cx
jne 0x41421c
cmp word [eax], dx
je 0x414232
xor eax, eax
pop ebp
ror dword [ebx - 0x13f4aa01], cl
mov edi, edi
push ebp
or ebp, esp

Function at 0x416e7e
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
dec ecx
add bh, bh
salc
cmp dword [0x496718], 0
mov esi, dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [0x496724], eax
je 0x416ead
cmp dword [0x49671c], 0
je 0x416ead
cmp dword [0x496720], 0
je 0x416ead
test eax, eax
jne 0x416ed1
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [0x49671c], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsFree]
mov dword [0x496718], 0x416a5b
mov dword [0x496720], esi
mov dword [0x496724], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x490334], eax
cmp eax, 0xffffffff
je 0x416fb1
push dword [0x49671c]
push eax
call esi
test eax, eax
je 0x416fb1
call fcn.00411a69
push dword [0x496718]
call fcn.0041696e
push dword [0x49671c]
mov dword [0x496718], eax
invalid

Function at 0x417e23
Capabilities:
Terminate process

Disassembly:
mov word [ebp - 0x244], gs
test ebx, ebx
jne 0x417e9c
push 2
call fcn.00422ec0
pop ecx
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00421fa7
add byte [eax], al
leave
ret

Function at 0x417ebd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push dword [0x49676c]
call fcn.004169e9
pop ecx
test eax, eax
je 0x417ed3
pop ebp
jmp eax
push 2
call fcn.00422ec0
pop ecx
Function at 0x4180c9
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, dword [edi*8 + 0x490ae0]
je 0x4180cd
inc edi
mov dword [ebp - 4], edi
cmp edi, 0x17
call dword [edi]
jb 0x4180bb
cmp edi, 0x17
jae 0x41824d
push 3
call fcn.004230a1
pop ecx
cmp eax, 1
je 0x41821b
push 3
call fcn.004230a1
pop ecx
test eax, eax
jne 0x418100
cmp dword [0x490328], 1
je 0x41821b
cmp ebx, 0xfc
je 0x41824d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov edi, 0x496770
push edi
call fcn.00422e0b
add esp, 0xc
test eax, eax
je 0x418136
push esi
push esi
push esi
push esi
push esi
call fcn.00417d93
add esp, 0x14
push 0x104
mov esi, 0x496789
push esi
push 0
mov byte [0x49688d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41817a
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00422e0b
add esp, 0xc
test eax, eax
je 0x41817a
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00417d93
add esp, 0x14
push esi
call fcn.004137e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4181bf
push esi
call fcn.004137e0
inc dword [ebx - 0x39fcc412]
push 3
mov ecx, 0x496a84
push 0x483174
sub ecx, eax
push ecx
push eax
call fcn.00422d56
add esp, 0x14
test eax, eax
je 0x4181bf
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00417d93
add esp, 0x14
jmp 0x4181c1
xor esi, esi
push 0x483170
push ebx
push edi
call fcn.00422c90
add esp, 0xc
test eax, eax
je 0x4181e1
push esi
push esi
push esi
push esi
push esi
call fcn.00417d93
add esp, 0x14
mov eax, dword [ebp - 4]
push dword [eax*8 + 0x490ae4]
push ebx
push edi
call fcn.00422c90
add esp, 0xc
test eax, eax
je 0x418206
push esi
push esi
push esi
push esi
push esi
call fcn.00417d93
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push edi
call fcn.00422f38
add esp, 0xc
jmp 0x41824d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebx, eax
cmp ebx, esi
je 0x41824d
cmp ebx, 0xffffffff
je 0x41824d
push 0
lea eax, [ebp - 8]
push eax
lea esi, [edi*8 + 0x490ae4]
push dword [esi]
call fcn.004137e0
pop ecx
push eax
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ef40
Capabilities:
Query environment variable

Disassembly:
cmp ch, 0x40
jae 0x41ef5e
cmp cl, 0x28
jae 0x41ef50
shrd eax, eax, cl
shr dword [esi + 0x33c68ac2], cl
rol byte [eax], cl
loope 0x41ef76
mov al, dh
xor edx, edx
add cl, ah
pop ds
shr eax, cl
jecxz 0x41ef8e
cmp byte [ebx], 0xf2
ret
invalid
call [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x41efa3
call dword [0x1482306]
jmp 0x41efa5
xor eax, eax
test eax, eax
je 0x41efb5
push eax
call 0x397f49
pop ecx
or eax, 0xffffffff
jmp 0x41efd0
mov eax, esi
sar eax, 5
retf
pop edi
push esi
pop ebp
ret

Function at 0x420d46
Capabilities:
Terminate process

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
xor esi, dword [esi + 0x3b]
invalid

Function at 0x421fa7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x490e80]
jne 0x421fb1
repz ret
jmp fcn.00426243

Function at 0x422f38
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004169e0
and dword [ebp - 4], 0
cmp dword [0x496efc], 0
mov ebx, eax
jne 0x422fe9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42309a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x483de0
push edi
call esi
test eax, eax
je 0x42309a
push eax
call fcn.0041696e
mov dword [esp], 0x483dd0
push edi
mov dword [0x496efc], eax
call esi
push eax
call fcn.0041696e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x496f00], eax
call esi
push eax
call fcn.0041696e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x496f04], eax
call esi
push eax
call fcn.0041696e
pop ecx
mov dword [0x496f0c], eax
test eax, eax
je 0x422fe9
push 0x483d88
push edi
call esi
push eax
call fcn.0041696e
pop ecx
mov dword [0x496f08], eax
mov eax, dword [0x496f08]
cmp eax, ebx
je 0x423041
cmp dword [0x496f0c], ebx
je 0x423041
push eax
call fcn.004169e9
push dword [0x496f0c]
mov esi, eax
call fcn.004169e9
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423041
test edi, edi
je 0x423041
call esi
test eax, eax
je 0x423038
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x423038
test byte [ebp - 0xc], 1
jne 0x423041
or dword [ebp + 0x10], 0x200000
jmp 0x42307a
mov eax, dword [0x496f00]
cmp eax, ebx
je 0x42307a
push eax
call fcn.004169e9
pop ecx
test eax, eax
je 0x42307a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42307a
mov eax, dword [0x496f04]
cmp eax, ebx
je 0x42307a
push eax
call fcn.004169e9
pop ecx
test eax, eax
je 0x42307a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x496efc]
call fcn.004169e9
pop ecx
test eax, eax
je 0x42309a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42309c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret