joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c81e
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x461934
call fcn.0043a238
sub esp, 0x264
push ebx
push edi
lea ecx, [ebp - 0x18]
call fcn.0042fd09
lea eax, [ebp - 0x18]
push 0x4144d8
push eax
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004475bb
lea eax, [ebp - 0x168]
mov byte [ebp - 4], 1
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x42c885
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00447326
or dword [ebp - 4], edi
lea ecx, [ebp - 0x18]
call fcn.00447326
jmp 0x42c9dc
push esi
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x270]
lea ecx, [ebp - 0x14]
push eax
call fcn.00447394
mov eax, dword [ebp - 0x168]
mov byte [ebp - 4], 2
and eax, 0x10
cmp al, 0x10
je 0x42c8f8
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00447555
push dword [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00420b8e
mov ecx, eax
call fcn.00420d04
lea eax, [ebp - 0x10]
mov ecx, 0x5b0a18
push eax
call fcn.0041ca73
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00447326
lea eax, [ebp - 0x168]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea ecx, [ebp - 0x14]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.00447326
cmp esi, ebx
jne 0x42c886
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
call fcn.00420b8e
mov ecx, eax
call fcn.00420e48
cmp eax, ebx
mov dword [ebp - 0x20], eax
je 0x42c9c4
mov eax, dword [0x414760]
mov dword [ebp - 0x10], eax
push 0x4639cc
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.00447394
mov eax, dword [0x414760]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x24]
push eax
mov byte [ebp - 4], 6
mov dword [ebp - 0x28], ebx
call fcn.0044745f
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 8
call fcn.00447326
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00420b8e
mov ecx, eax
call fcn.00420e50
lea esi, [ebp - 0x28]
call fcn.0042cc4f
mov ecx, eax
mov edx, esi
call fcn.0042cd49
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 4
call fcn.00447326
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00447326
cmp dword [ebp - 0x20], ebx
jne 0x42c93a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00447326
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00447326
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42e7d8
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x461dbc
call fcn.0043a238
sub esp, 0x210
push ebx
push esi
push edi
lea ecx, [ebp - 0x1c]
call fcn.00416ed8
push dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x21c]
push eax
call esi
lea ecx, [ebp - 0x1c]
call fcn.00447326
lea eax, [ebp - 0x11c]
push 0x414548
push eax
call esi
lea ecx, [ebp - 0x18]
call fcn.00416f0c
mov eax, dword [0x414760]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
call fcn.0041787f
mov ecx, eax
call fcn.00417518
cmp eax, 0xfffffffe
je 0x42e85f
cmp eax, 0xffffffff
jne 0x42e873
push 0x414540
lea ecx, [ebp - 0x14]
call fcn.004474af
mov dword [ebp - 0x10], 0x2af9
jmp 0x42e873
push 0x414534
lea ecx, [ebp - 0x14]
call fcn.004474af
mov dword [ebp - 0x10], 0x2afa
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], ebx
jne 0x42e883
push 1
pop esi
jmp 0x42e97c
mov edi, 0x41382c
lea eax, [ebp - 0x11c]
push edi
push ebx
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, ebx
jne 0x42e87b
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
push ebx
push 0x24
call fcn.0042c1ce
push eax
call fcn.00452542
cmp eax, 6
jne 0x42e95b
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0x10]
push eax
call fcn.0044709b
push 0x20
lea ecx, [ebp - 0x10]
pop esi
mov byte [ebp - 4], 2
push esi
push 0x5c
call fcn.00444a7f
lea ecx, [ebp - 0x10]
push esi
push 0x2f
call fcn.00444a7f
lea ecx, [ebp - 0x10]
push esi
push 0x3a
call fcn.00444a7f
lea ecx, [ebp - 0x10]
push esi
push 0x2a
call fcn.00444a7f
lea ecx, [ebp - 0x10]
push esi
push 0x40
call fcn.00444a7f
lea ecx, [ebp - 0x10]
push esi
push 0x7c
call fcn.00444a7f
lea ecx, [ebp - 0x10]
push esi
push 0x25
call fcn.00444a7f
lea ecx, [ebp - 0x10]
push esi
push 0x3c
call fcn.00444a7f
lea ecx, [ebp - 0x10]
push esi
push 0x3e
call fcn.00444a7f
lea ecx, [ebp - 0x10]
push esi
push 0x3f
call fcn.00444a7f
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
call fcn.0042e9a4
lea ecx, [ebp - 0x10]
mov esi, eax
mov byte [ebp - 4], 1
call fcn.00447326
jmp 0x42e95e
push 1
pop esi
cmp esi, ebx
je 0x42e97c
push edi
lea eax, [ebp - 0x11c]
push 0x4138d4
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00447326
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00447326
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x42ea42
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
mov eax, 0x461df8
call fcn.0043a238
sub esp, 0x220
push edi
mov edi, edx
mov dword [ebp - 0x20], ecx
call fcn.0045ca69
test eax, eax
je 0x42ec38
push ebx
push esi
push 0x41455c
call fcn.0043b83b
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00447394
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [eax - 8], ebx
jne 0x42eaca
lea eax, [ebp - 0x12c]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x12c]
push eax
call fcn.0043b7c0
cmp eax, 3
pop ecx
jne 0x42eabb
cmp byte [ebp - 0x12b], 0x3a
jne 0x42eabb
mov byte [ebp - 0x12a], bl
lea eax, [ebp - 0x12c]
lea ecx, [ebp - 0x10]
push eax
call fcn.004474af
mov esi, 0x414458
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.004475bb
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004475bb
push esi
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 2
push eax
call fcn.004475bb
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.0044745f
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00447326
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00447326
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.00447326
lea eax, [ebp - 0x10]
push edi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.004475bb
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 4
push eax
push 0x4077f0
push 1
push ebx
push 0x4077e0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x42ec1d
mov eax, dword [ebp + 0xc]
push dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0xc]
push 0x4639cc
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp + 0xc]
lea edx, [ebp - 0x18]
push edx
push 0x407850
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x42ec14
lea eax, [ebp - 0x14]
lea ecx, [ebp + 8]
push eax
call fcn.0044709b
lea ecx, [ebp + 8]
mov byte [ebp - 4], 5
call fcn.0044785a
mov esi, 0x414554
lea ecx, [ebp + 8]
push esi
call fcn.00444dee
cmp eax, 0xffffffff
jne 0x42ebd1
push esi
lea ecx, [ebp - 0x14]
call fcn.00447702
lea eax, [ebp - 0x22c]
push 0x104
push eax
push 0xffffffffffffffff
push dword [ebp - 0x14]
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x22c]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 4
call fcn.00447326
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00447326
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00447326
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x42f412
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
ja 0x42f468
xor edx, edx
sub eax, edx
je 0x42f450
dec eax
dec eax
je 0x42f449
dec eax
je 0x42f442
sub eax, 8
je 0x42f43b
mov ecx, 0x2ee1
jmp 0x42f455
mov ecx, 0x2ee3
jmp 0x42f455
mov ecx, 0x2ee5
jmp 0x42f455
mov ecx, 0x2ee4
jmp 0x42f455
mov ecx, 0x2ee2
push edx
push edx
mov edx, esi
call fcn.0042c1ce
push eax
call fcn.00452542
xor eax, eax
pop esi
ret
push 1
pop eax
pop esi
ret

Function at 0x42f46d
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x461edc
call fcn.0043a238
push ecx
push esi
push edi
mov esi, ecx
call fcn.0041ad36
xor edi, edi
xor ecx, ecx
cmp eax, edi
je 0x42f48c
mov ecx, dword [eax + 0x1c]
push 3
push edi
push edi
push esi
push 0x413f74
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor esi, esi
cmp eax, 0x1a
jg 0x42f4f2
je 0x42f4eb
mov ecx, eax
sub ecx, edi
je 0x42f4e4
dec ecx
dec ecx
je 0x42f4dd
dec ecx
je 0x42f4d6
dec ecx
dec ecx
je 0x42f4cf
sub ecx, 3
je 0x42f4c8
sub ecx, 3
jne 0x42f52b
mov esi, 0x32cd
jmp 0x42f530
mov esi, 0x32d5
jmp 0x42f530
mov esi, 0x32ce
jmp 0x42f530
mov esi, 0x32cc
jmp 0x42f530
mov esi, 0x32cb
jmp 0x42f530
mov esi, 0x32ca
jmp 0x42f530
mov esi, 0x32d6
jmp 0x42f530
mov ecx, eax
sub ecx, 0x1b
je 0x42f526
dec ecx
je 0x42f51f
dec ecx
je 0x42f518
dec ecx
je 0x42f511
dec ecx
je 0x42f50a
dec ecx
je 0x42f575
jmp 0x42f52b
mov esi, 0x32d4
jmp 0x42f530
mov esi, 0x32d0
jmp 0x42f530
mov esi, 0x32d1
jmp 0x42f530
mov esi, 0x32d2
jmp 0x42f530
mov esi, 0x32cf
cmp eax, 0x20
jge 0x42f575
mov ecx, 0x32c9
call fcn.0042c038
lea ecx, [ebp - 0x10]
push eax
call fcn.00447394
cmp esi, edi
mov dword [ebp - 4], edi
je 0x42f55a
mov ecx, esi
call fcn.0042c038
lea ecx, [ebp - 0x10]
push eax
call fcn.00447702
push edi
push 0x30
push dword [ebp - 0x10]
call fcn.00452542
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00447326
xor eax, eax
jmp 0x42f578
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x42fb96
Capabilities:
Create directory
Set current directory
Set file attributes

Disassembly:
mov eax, 0x461f84
call fcn.0043a238
push ecx
push ebx
push edi
push ecx
lea ecx, [ebp - 0x10]
call fcn.00447394
mov eax, dword [ebp - 0x10]
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
push dword [eax - 8]
call fcn.00447756
mov edi, eax
cmp byte [edi + 4], bl
lea eax, [edi + 4]
je 0x42fc09
push esi
mov esi, eax
cmp byte [esi], 0x5c
jne 0x42fc03
push edi
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp eax, ebx
jne 0x42fc00
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x102
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call fcn.0042fe32
mov ecx, eax
mov edx, edi
call fcn.0042febc
mov byte [esi], 0x5c
inc esi
cmp byte [esi], bl
jne 0x42fbcc
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00447326
mov ecx, dword [ebp - 0xc]
push 1
mov dword fs:[0], ecx
pop eax
pop edi
pop ebx
leave
ret
Function at 0x42fc26
Capabilities:
Get common file path

Disassembly:
mov eax, 0x461fc7
call fcn.0043a238
sub esp, 0x400
and dword [ebp - 0x20], 0
mov dword [ebp - 0x18], ecx
push ebx
lea ecx, [ebp - 0x14]
call fcn.00416ed8
push 1
lea eax, [ebp - 0x40c]
pop ebx
push eax
push 0x3e8
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x40c]
lea ecx, [ebp - 0x10]
push eax
call fcn.00447394
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x24]
push 0x4146c4
push eax
call fcn.0044762f
push 0x4146bc
push eax
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 3
push eax
call fcn.004475bb
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.0044773e
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call fcn.00447326
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 2
call fcn.00447326
mov ecx, dword [ebp - 0x10]
call fcn.0042fb96
test eax, eax
jne 0x42fcd3
push eax
push eax
push 0x414690
call fcn.00452542
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x10]
push eax
call fcn.0044709b
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00447326
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00447326
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x42fd93
Capabilities:
Access peb ldr_data
Get common file path
Get ntdll base address

Disassembly:
mov eax, 0x462011
call fcn.0043a238
sub esp, 0x3ec
mov eax, dword [0x414760]
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], eax
xor eax, eax
mov dword [esi + 4], 0x4016f0
mov dword [ebp - 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0xc], eax
push 0x11
mov ecx, 0x4027c8
pop edi
mov dword [esi + 0x18], ecx
push 0xa
mov dword [esi + 0x1c], eax
pop edx
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], edx
mov dword [esi + 0x34], ecx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], edx
lea eax, [ebp - 0x3f8]
mov byte [ebp - 4], 3
push eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x3f8]
mov ecx, esi
push eax
call fcn.004474af
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x42fefc
Capabilities:
Delete directory
Set current directory

Disassembly:
mov eax, 0x462060
call fcn.0043a238
sub esp, 0xc
mov eax, dword [0x414760]
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], eax
push dword [esi]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [esi + 0x24]
neg eax
sbb eax, eax
test eax, eax
mov dword [ebp - 0x18], eax
je 0x42ff8c
lea edi, [esi + 0x18]
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.00430f5f
test byte [ebp - 0x14], 2
je 0x42ff55
mov ecx, dword [ebp - 0x10]
call fcn.0042f58e
jmp 0x42ff5e
push dword [ebp - 0x10]
call fcn.004448c5
pop ecx
mov ecx, dword [ebp - 0x10]
call fcn.0041dd5b
test eax, eax
je 0x42ff86
test byte [ebp - 0x14], 1
je 0x42ff86
mov edx, dword [ebp - 0x10]
mov ecx, esi
call fcn.00430eb4
test eax, eax
jne 0x42ff86
mov ecx, dword [ebp - 0x10]
call fcn.0042f9d4
cmp dword [ebp - 0x18], 0
jne 0x42ff32
lea ecx, [esi + 0x18]
call fcn.00429fba
mov eax, dword [esi + 0xc]
test eax, eax
jle 0x42ffbd
lea edi, [eax - 1]
test edi, edi
jl 0x42ffbd
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x10]
lea eax, [eax + edi*4]
push eax
call fcn.0044745f
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
dec edi
jns 0x42ffa2
push 0xffffffffffffffff
push 0
lea ecx, [esi + 4]
call fcn.0041cdb1
lea ecx, [esi + 0x34]
call fcn.00429fba
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00447326
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x440c9e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4162f0
cmp edx, dword [eax]
je 0x440cc0
add eax, 8
inc ecx
cmp eax, 0x416380
jl 0x440cb1
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4162f0]
jne 0x440dee
mov eax, dword [0x5b2b20]
cmp eax, 1
je 0x440dc8
test eax, eax
jne 0x440cf1
cmp dword [0x415854], 1
je 0x440dc8
cmp edx, 0xfc
je 0x440dee
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x440d28
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0043b6d0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0043b7c0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x440d6b
lea eax, [ebp - 0x1a4]
push eax
call fcn.0043b7c0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4142d4
push edi
call fcn.00442260
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0043b6d0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0043b6e0
lea eax, [ebp - 0xa0]
push 0x4142a8
push eax
call fcn.0043b6e0
push dword [esi + 0x4162f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0043b6e0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00442f52
add esp, 0x2c
pop edi
jmp 0x440dee
lea eax, [ebp + 8]
lea esi, [esi + 0x4162f4]
push 0
push eax
push dword [esi]
call fcn.0043b7c0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x4493b2
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4493ea
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004477cd
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004477a5
jmp 0x4493f6
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x44af30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x44af72
call fcn.0045ad63
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x44af72
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x44af69
xor eax, eax
jmp 0x44af7a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0044af80
pop edi
pop esi
pop ebx
ret 4
Function at 0x44b8d6
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.0045ad63
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x44b907
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.0044b91a
pop edi
pop esi
pop ebx
ret 8

Function at 0x45c0ac
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x45c0da
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x45c0f8
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0045c012
jmp 0x45c0f8
mov eax, dword [esi + 0x14]
test eax, eax
je 0x45c0f8
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0045c012
test edi, edi
mov eax, edi
jne 0x45c0e2
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x100118d9
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0xa000d
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100118ec
sub eax, ecx
sar eax, 1
push esi
mov esi, dword [sym.imp.MSVCR100.dll_fwrite]
je 0x10011914
push dword [ebp + 0xc]
add eax, eax
push 1
push eax
push dword [ebp + 8]
call esi
add esp, 0x10
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push 1
push 4
push eax
call esi
add esp, 0x10
pop esi
leave
ret 8
Function at 0x10012a14
Capabilities:
Enumerate pe sections

Disassembly:
push 4
mov eax, 0x1004b0aa
call fcn.1004a52d
mov eax, dword [0x10115084]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 0x18]
test ecx, ecx
movzx ecx, word [eax + 0x14]
lea ebx, [ecx + eax + 0x18]
movzx eax, word [eax + 6]
xor edx, edx
test eax, eax
je 0x10012ba9
mov ecx, dword [ebx + 0xc]
mov edi, dword [ebp + 0xc]
cmp edi, ecx
jb 0x10012a56
mov esi, dword [ebx + 8]
add esi, ecx
cmp edi, esi
jb 0x10012a60
inc edx
add ebx, 0x28
cmp edx, eax
jb 0x10012a43
jmp 0x10012a6f
add edi, dword [ebp + 0x10]
add ecx, dword [ebx + 8]
cmp edi, ecx
mov edi, dword [ebp + 0xc]
jbe 0x10012a6f
mov edx, eax
cmp edx, eax
jae 0x10012ba9
xor esi, esi
cmp esi, dword [0x10116cb8]
jge 0x10012aa0
mov ecx, dword [0x10116cb0]
push esi
call fcn.1001256e
cmp dword [eax], edi
je 0x10012a9a
inc esi
cmp esi, dword [0x10116cb8]
jl 0x10012a81
cmp esi, dword [0x10116cb8]
jne 0x10012b39
cmp dword [0x10116cb4], 0
jne 0x10012ad5
push 0x10
call fcn.10042e16
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor eax, eax
mov dword [ebp - 4], eax
cmp ecx, eax
je 0x10012acc
push 0x18
call fcn.100125e6
or dword [ebp - 4], 0xffffffff
mov dword [0x10116cb4], eax
cmp dword [0x10116cb0], 0
jne 0x10012b0a
push 0x10
call fcn.10042e16
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 1
test ecx, ecx
je 0x10012aff
push 0x18
call fcn.100125e6
jmp 0x10012b01
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [0x10116cb0], eax
push dword [0x10116cb8]
mov ecx, dword [0x10116cb4]
call fcn.1001256e
mov ecx, dword [ebp + 0x10]
mov dword [eax], ecx
mov eax, dword [0x10116cb8]
mov ecx, dword [0x10116cb0]
inc dword [0x10116cb8]
push eax
call fcn.1001256e
jmp 0x10012b58
mov ecx, dword [0x10116cb4]
push esi
call fcn.1001256e
mov edi, dword [ebp + 0x10]
cmp dword [eax], edi
jae 0x10012b5a
mov ecx, dword [0x10116cb4]
push esi
call fcn.1001256e
mov dword [eax], edi
push 5
mov edi, 0x1000286c
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
mov edx, 0x10002868
jne 0x10012b76
mov edx, 0x10002864
jmp 0x10012b8b
push 6
mov edi, 0x1000285c
mov esi, ebx
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x10012b8b
mov edx, 0x10002858
mov edi, dword [ebp + 8]
mov eax, 0x10078a80
cmp edi, eax
jb 0x10012b9b
xor eax, eax
jmp 0x10012b9d
sub eax, edi
push dword [ebp + 0xc]
push edx
push 0x10002850
push eax
jmp 0x10012bcf
mov edi, dword [ebp + 8]
mov eax, 0x10078a80
cmp edi, eax
jb 0x10012bb9
xor esi, esi
jmp 0x10012bbd
mov esi, eax
sub esi, edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x10002818
call fcn.1001c228
push eax
push esi
push edi
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x14
add edi, eax
mov eax, edi
call fcn.1004a605
ret 0xc