joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407489
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x42eb80]
xor eax, ebp
cmp dword [0x42e318], 0xffffffff
mov dword [ebp - 4], eax
jne 0x4074e6
push edi
push 0x24
pop ecx
xor eax, eax
mov dword [ebp - 0x98], 0x94
lea edi, [ebp - 0x94]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
jne 0x4074db
mov dword [0x42e318], 6
jmp 0x4074e6
mov eax, dword [ebp - 0x94]
mov dword [0x42e318], eax
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [0x42e318], 5
setg al
xor ecx, ebp
call fcn.0040f6e1
leave
ret

Function at 0x4074fe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x407587
cmp dword [ebp + 0xc], 0x104
jl 0x407587
cmp byte [0x4301b0], bl
push esi
mov esi, 0x4301b0
jne 0x407577
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x407577
lea eax, [ebp - 4]
push eax
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x407562
push esi
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x407562
push str.ppStream
push esi
call fcn.00410e30
pop ecx
pop ecx
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00411b4d
add esp, 0xc
pop esi
pop ebx
leave
ret

Function at 0x40758a
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x42eb80]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 0x1a0]
mov dword [ebp + 0x194], eax
mov eax, dword [ebp + 0x1a8]
push esi
mov esi, dword [ebp + 0x1b4]
push edi
mov edi, dword [ebp + 0x1a4]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x1ac]
mov dword [ebp - 0x80], edi
mov dword [ebp - 0x7c], eax
call fcn.00407489
test eax, eax
je 0x4075e6
push 0x5c
push esi
call fcn.00410aa6
test eax, eax
pop ecx
pop ecx
je 0x4075f6
push esi
push dword [ebp + 0x1b0]
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
push edi
jmp 0x407645
xor eax, eax
mov byte [ebp - 0x74], 0
mov ecx, 0x81
lea edi, [ebp - 0x73]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x74]
push 0x208
push eax
call fcn.004074fe
lea eax, [ebp - 0x74]
push 0x424588
push eax
call fcn.00410e30
lea eax, [ebp - 0x74]
push esi
push eax
call fcn.00410e30
add esp, 0x18
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x1b0]
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
push dword [ebp - 0x80]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp + 0x194]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f6e1
add ebp, 0x198
leave
ret 0x18
Function at 0x407afa
Capabilities:
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3b0]
sub esp, 0x430
mov eax, dword [0x42eb80]
xor eax, ebp
push ebx
mov dword [ebp + 0x3ac], eax
push esi
mov esi, dword [ebp + 0x3b8]
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 0x34]
lea eax, [ebp + 0x2e0]
push dword [ebp - 0x38]
push eax
call fcn.00407a82
lea eax, [ebp + 0x2e0]
push eax
push str.Error_occurred_at__s._r_n
push esi
call fcn.00406862
push 0x208
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.0040f650
add esp, 0x24
push 0x102
lea eax, [ebp - 0x2c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
ja 0x407b84
push str.Unknown
lea eax, [ebp - 0x2c]
push eax
call ebx
push 0x104
lea eax, [ebp + 0x1dc]
push 0
push eax
call fcn.0040f650
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 0x1dc]
push eax
mov dword [ebp - 0x30], 0x102
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x407bc4
push str.Unknown
lea eax, [ebp + 0x1dc]
push eax
call ebx
lea eax, [ebp + 0x1dc]
push eax
lea eax, [ebp - 0x2c]
push eax
push str._s__run_by__s._r_n
push esi
call fcn.00406862
lea eax, [ebp + 0x378]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x344]
push eax
call fcn.00404061
lea eax, [ebp + 0x378]
push eax
lea eax, [ebp + 0x344]
push eax
push str.Operating_system:___s___s_._r_n
push esi
call fcn.00406862
add esp, 0x2c
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
push str._d_processor_s___type__d._r_n
push esi
call fcn.00406862
add esp, 0x10
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x58], 0x20
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push dword [ebp - 0x54]
push str._d___memory_in_use._r_n
push esi
call fcn.00406862
mov eax, dword [ebp - 0x50]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_physical_memory._r_n
push esi
call fcn.00406862
mov eax, dword [ebp - 0x4c]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_physical_memory_free._r_n
push esi
call fcn.00406862
mov eax, dword [ebp - 0x48]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_paging_file._r_n
push esi
call fcn.00406862
mov eax, dword [ebp - 0x44]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_paging_file_free._r_n
push esi
call fcn.00406862
mov eax, dword [ebp - 0x40]
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space._r_n
push esi
call fcn.00406862
mov eax, dword [ebp - 0x3c]
add esp, 0x48
add eax, 0xfffff
shr eax, 0x14
push eax
push str._d_MBytes_user_address_space_free._r_n
push esi
call fcn.00406862
mov ecx, dword [ebp + 0x3ac]
add esp, 0xc
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f6e1
add ebp, 0x3b0
leave
ret
Function at 0x4081f8
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [ebp - 0x44]
xor edx, edx
mov eax, 0x40000000
div ebx
push 0
pop edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], 1
mov esi, eax
shl esi, 2
je 0x40828f
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov eax, edi
imul eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
test eax, eax
je 0x40827a
mov eax, dword [ebp - 0x18]
test eax, eax
jbe 0x40827a
div ebx
add edi, eax
cmp dword [ebp - 0x14], 0x1000
jne 0x408283
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 8]
jbe 0x408283
push dword [ebp - 4]
mov dword [ebp - 8], eax
push eax
push dword [ebp + 8]
call fcn.00407e8a
add esp, 0xc
test eax, eax
je 0x408283
inc dword [ebp - 4]
jmp 0x408283
mov eax, 0x10000
div ebx
add edi, eax
cmp edi, esi
jb 0x40822b
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
jne 0x408291
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4082ab
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x4232de
call fcn.00410238
sub esp, 0x724
mov eax, dword [0x42eb80]
mov ecx, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x724], eax
mov dword [ebp - 0x728], ecx
je 0x4084e5
push esi
push edi
call fcn.0041cce2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x718], esi
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x114], bl
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x114]
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x720]
call fcn.0040173a
push 0x5c
lea ecx, [ebp - 0x720]
mov byte [ebp - 4], 1
call fcn.00407400
cmp eax, 0xffffffff
je 0x408389
inc eax
push eax
lea eax, [ebp - 0x71c]
push eax
lea ecx, [ebp - 0x720]
call fcn.00407445
push eax
lea ecx, [ebp - 0x718]
mov byte [ebp - 4], 2
call fcn.00401626
mov ecx, dword [ebp - 0x71c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401237
mov esi, dword [ebp - 0x718]
cmp dword [esi - 0xc], ebx
je 0x4084cd
xor eax, eax
push 0x7f
mov byte [ebp - 0x314], bl
pop ecx
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x714], bl
mov ecx, 0xff
lea edi, [ebp - 0x713]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x730]
push eax
call fcn.00407727
push dword [ebp - 0x724]
lea eax, [ebp - 0x314]
push esi
push str._s_s.log
push eax
call fcn.004102bf
add esp, 0x10
push str._Y__m__d__H:_M:_S
lea eax, [ebp - 0x724]
push eax
lea ecx, [ebp - 0x730]
call fcn.004079df
cmp dword [0x42e368], 0x10
mov ecx, dword [0x42e354]
jae 0x408412
mov ecx, 0x42e354
lea edx, [ebp - 0x114]
push edx
push ecx
push dword [eax]
lea eax, [ebp - 0x714]
push str._r_n_r_n
push eax
call fcn.004102bf
mov ecx, dword [ebp - 0x724]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.00401237
push ebx
push 0x80
push 4
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x71c], edi
je 0x4084cd
push 2
push ebx
push ebx
push edi
mov dword [ebp - 0x718], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 0x718]
push eax
lea eax, [ebp - 0x714]
push eax
call fcn.0040f5c0
pop ecx
push eax
lea eax, [ebp - 0x714]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
call edi
push ebx
lea eax, [ebp - 0x718]
push eax
push dword [ebp - 0x728]
call fcn.0040f5c0
pop ecx
push eax
push dword [ebp - 0x728]
push dword [ebp - 0x71c]
call edi
push dword [ebp - 0x71c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x720]
add ecx, 0xfffffff0
call fcn.00401237
lea ecx, [esi - 0x10]
call fcn.00401237
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.0040f6e1
leave
ret
Function at 0x408a2c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x42eb80]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x210], edi
call fcn.00407489
test eax, eax
je 0x408a68
push 0x5c
push esi
call fcn.00410aa6
test eax, eax
pop ecx
pop ecx
je 0x408a6f
push esi
push dword [ebp + 0x10]
push edi
jmp 0x408aca
xor eax, eax
mov byte [ebp - 0x20c], 0
mov ecx, 0x81
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.004074fe
lea eax, [ebp - 0x20c]
push 0x424588
push eax
call fcn.00410e30
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.00410e30
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x210]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f6e1
leave
ret 0x10

Function at 0x409048
Capabilities:
Delete file

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, dword [esp + 0xc]
push esi
call fcn.00408bb0
cmp dword [esi + 0x18], 0x10
jb 0x409062
mov esi, dword [esi + 4]
jmp 0x409065
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
pop esi
ret 8

Function at 0x4094f1
Capabilities:
Delete directory

Disassembly:
mov eax, 0x423392
call fcn.00410238
sub esp, 0x24
push esi
mov esi, ecx
lea ecx, [ebp - 0x30]
call fcn.0040ec20
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0040173a
push str..
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00401698
push 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x30]
call fcn.0040ecb3
test eax, eax
je 0x4095ad
push edi
lea ecx, [ebp - 0x30]
call fcn.0040eb17
lea ecx, [ebp - 0x30]
mov edi, eax
call fcn.0040ebe7
test eax, eax
jne 0x4095a8
mov eax, dword [ebp - 0x30]
push 0x10
lea ecx, [ebp - 0x30]
call dword [eax + 0x38]
test eax, eax
je 0x409588
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040ee39
push dword [eax]
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004094f1
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 1
call fcn.00401237
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.0040ee39
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401237
test edi, edi
jne 0x40953b
pop edi
lea ecx, [ebp - 0x30]
call fcn.0040ea47
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401237
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040ec44
mov ecx, dword [ebp - 0xc]
mov al, 1
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x4104de
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x4104fb
call fcn.004126c3
mov dword [eax], 0x16
xor eax, eax
jmp 0x410565
push esi
push 0x8c
push 1
call fcn.00415bbc
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x410550
push esi
call fcn.00414267
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x41052e
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x410449
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x410564
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.004118a4
test ebx, ebx
pop ecx
je 0x410562
push ebx
call fcn.004126d5
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41062d
Capabilities:
Terminate process

Disassembly:
push 8
push 0x428f00
call fcn.004119f8
push 8
call fcn.00415de6
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4328ec], esi
jne 0x410661
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4328e8], esi
mov al, byte [ebp + 0x10]
mov byte [0x4328e4], al
cmp dword [ebp + 0xc], edi
jne 0x4106ab
cmp dword [0x43418c], edi
je 0x41069b
mov eax, dword [0x434188]
sub eax, 4
mov dword [0x434188], eax
cmp eax, dword [0x43418c]
jb 0x41069b
mov eax, dword [eax]
cmp eax, edi
je 0x41067c
call eax
jmp 0x41067c
push 0x42e0a4
mov eax, 0x42e09c
call fcn.004105ab
pop ecx
push 0x42e0b0
mov eax, 0x42e0a8
call fcn.004105ab
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x4106dc
cmp dword [ebp + 0x10], edi
jne 0x4106ea
mov dword [0x4328ec], esi
push dword [ebp + 8]
call fcn.00410569
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x4106e9
push 8
call fcn.00415d31
pop ecx
ret
call fcn.00411a33
ret
Function at 0x411915
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00410320
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4119b0
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4328ac]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4119b0
cmp eax, 1
je 0x4119d1
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4119b0
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x41197d
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4119ac
xor eax, eax
inc eax
jmp 0x4119f0
cmp edi, eax
jae 0x4119b4
xor eax, eax
jmp 0x4119f0
cmp eax, esi
jae 0x4119bb
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4328ac]
jmp 0x4119d4
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412804
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x429148
call fcn.004119f8
mov edi, 0x94
mov eax, edi
call fcn.00410320
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4328ac], ecx
mov eax, dword [esi + 4]
mov dword [0x4328b8], eax
mov edx, dword [esi + 8]
mov dword [0x4328bc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4328b0], esi
cmp ecx, 2
je 0x412864
or esi, 0x8000
mov dword [0x4328b0], esi
shl eax, 8
add eax, edx
mov dword [0x4328b4], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x41289f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41289f
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4128b7
cmp eax, 0x20b
je 0x4128a4
mov dword [ebp - 0x1c], esi
jmp 0x4128cb
cmp dword [ecx + 0x84], 0xe
jbe 0x41289f
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4128c5
cmp dword [ecx + 0x74], 0xe
jbe 0x41289f
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00417320
pop ecx
test eax, eax
jne 0x4128df
push 0x1c
call fcn.004127e0
pop ecx
call fcn.00414461
test eax, eax
jne 0x4128f0
push 0x10
call fcn.004127e0
pop ecx
call fcn.00415e17
mov dword [ebp - 4], esi
call fcn.004190f3
test eax, eax
jge 0x412909
push 0x1b
call fcn.004127bb
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x434180], eax
call fcn.00418fd1
mov dword [0x4328f8], eax
call fcn.00418f2f
test eax, eax
jge 0x41292f
push 8
call fcn.004127bb
pop ecx
call fcn.00418cfc
test eax, eax
jge 0x412940
push 9
call fcn.004127bb
pop ecx
push 1
call fcn.004105c3
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x412956
push eax
call fcn.004127bb
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00418c9f
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x412977
movzx eax, word [ebp - 0x40]
jmp 0x41297a
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00407134
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x412998
push edi
call fcn.004106f0
call fcn.00410712
jmp 0x4129ca
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00411a33
ret
Function at 0x416568
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x42eb80]
xor ecx, ecx
xor eax, ebp
cmp dword [ebp + 0x3b4], ecx
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x78], ecx
jne 0x4165a4
xor eax, eax
jmp 0x41670e
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3ac]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x432e00]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x4165e2
push 2
push ecx
push ecx
push dword [ebp + 0x3ac]
call fcn.0041a014
add esp, 0x10
xor ecx, ecx
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x41667c
cmp dword [ebp + 0x3b4], ecx
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x68], ecx
jbe 0x4166df
jmp 0x416606
xor ecx, ecx
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp - 0x70]
sub ecx, dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x416641
mov edx, dword [ebp - 0x70]
inc dword [ebp - 0x70]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x416632
inc dword [ebp - 0x78]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x6c]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x400
jl 0x416612
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4166a0
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x74], eax
cmp eax, edi
jl 0x4166a9
mov eax, dword [ebp - 0x70]
sub eax, dword [ebp - 0x7c]
cmp eax, dword [ebp + 0x3b4]
jb 0x416604
jmp 0x4166a9
push ecx
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4166a0
mov eax, dword [ebp - 0x80]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x74], eax
jmp 0x4166a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x416709
cmp dword [ebp - 0x68], eax
je 0x4166dc
push 5
pop esi
cmp dword [ebp - 0x68], esi
jne 0x4166d1
call fcn.004126c3
mov dword [eax], 9
call fcn.004126cc
mov dword [eax], esi
jmp 0x416704
push dword [ebp - 0x68]
call fcn.004126d5
pop ecx
jmp 0x416704
mov edi, dword [ebp - 0x7c]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4166f1
cmp byte [edi], 0x1a
jne 0x4166f1
xor eax, eax
jmp 0x41670c
call fcn.004126c3
mov dword [eax], 0x1c
call fcn.004126cc
and dword [eax], 0
or eax, 0xffffffff
jmp 0x41670c
sub eax, dword [ebp - 0x78]
pop esi
pop ebx
mov ecx, dword [ebp + 0x3a0]
xor ecx, ebp
pop edi
call fcn.0040f6e1
add ebp, 0x3a4
leave
ret