joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401cc0
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50c
mov eax, dword [0x410350]
mov dword [ebp - 4], eax
mov dword [0x410e48], 0
mov dword [0x410e4c], 0
mov dword [0x410e50], 0
mov dword [0x410e54], 0
mov dword [0x410e58], 0
mov dword [ebp - 0x4c0], 0x9c
lea eax, [ebp - 0x4c0]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x4bc], 6
jne 0x401e39
push 0x40fce4
push str.powercfg__l
call fcn.00403b29
add esp, 8
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x401d90
mov ecx, dword [ebp - 0x40c]
push ecx
push 0x3ff
lea edx, [ebp - 0x408]
push edx
call fcn.00403a7f
add esp, 0xc
test eax, eax
je 0x401d90
lea eax, [ebp - 0x509]
push eax
push 0x410e08
push str._s__s__s__s__s__c
lea ecx, [ebp - 0x408]
push ecx
call fcn.00403a4b
add esp, 0x10
cmp eax, 2
jne 0x401d8e
jmp 0x401d90
jmp 0x401d48
push 0x44
push 0
lea edx, [ebp - 0x508]
push edx
call fcn.004039c0
add esp, 0xc
mov dword [ebp - 0x508], 0x44
push 0x10
push 0
lea eax, [ebp - 0x420]
push eax
call fcn.004039c0
add esp, 0xc
push str.powercfg__s_8c5e7fda_e8bf_4a96_9a85_a6e23a8c635c
call fcn.00403a20
add esp, 4
mov dword [ebp - 0x410], eax
lea ecx, [ebp - 0x420]
push ecx
lea edx, [ebp - 0x508]
push edx
push 0
push 0
push 0x8000000
push 0
push 0
push 0
mov eax, dword [ebp - 0x410]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x420]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x410e48], 1
mov eax, 1
jmp 0x401e93
push 0
push 0x401ea0
call sub.POWRPROF.dll_EnumPwrSchemes
cmp dword [0x410e48], 0
jne 0x401e76
call fcn.00401ef0
push 0
push 0x401ea0
call sub.POWRPROF.dll_EnumPwrSchemes
cmp dword [0x410e48], 0
jne 0x401e6c
xor eax, eax
jmp 0x401e93
mov dword [0x410e4c], 1
push 0x410e50
call sub.POWRPROF.dll_GetActivePwrScheme
push 0
push 0
mov ecx, dword [0x410e54]
push ecx
call sub.POWRPROF.dll_SetActivePwrScheme
movzx eax, al
mov ecx, dword [ebp - 4]
call fcn.004039a9
mov esp, ebp
pop ebp
ret
Function at 0x402030
Capabilities:
Check os version
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x410350]
mov dword [ebp - 0x18], eax
cmp dword [0x410e48], 0
jne 0x402051
xor eax, eax
jmp 0x402165
mov dword [ebp - 0xb8], 0x9c
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0xb4], 6
jne 0x40211d
push 0x44
push 0
lea ecx, [ebp - 0x100]
push ecx
call fcn.004039c0
add esp, 0xc
mov dword [ebp - 0x100], 0x44
push 0x10
push 0
lea edx, [ebp - 0x14]
push edx
call fcn.004039c0
add esp, 0xc
push 0x410e08
push str.powercfg__s__s
lea eax, [ebp - 0x148]
push eax
call fcn.0040420d
add esp, 0xc
lea ecx, [ebp - 0x148]
push ecx
call fcn.00403a20
add esp, 4
mov dword [ebp - 4], eax
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x100]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
lea ecx, [ebp - 0x148]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x402165
push 0
push 0
mov edx, dword [0x410e50]
push edx
call sub.POWRPROF.dll_SetActivePwrScheme
movzx eax, al
mov dword [ebp - 0x104], eax
cmp dword [0x410e4c], 0
je 0x40214b
mov ecx, dword [0x410e58]
push ecx
call sub.POWRPROF.dll_DeletePwrScheme
mov dword [0x410e48], 0
mov dword [0x410e4c], 0
mov eax, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x18]
call fcn.004039a9
mov esp, ebp
pop ebp
ret

Function at 0x402180
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4021ac
xor eax, eax
jmp 0x4021de
lea eax, [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x4021f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0x410e5c
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov esp, ebp
pop ebp
ret

Function at 0x402260
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40228c
xor eax, eax
jmp 0x4022b0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 4], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x4022c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x50], eax
mov dword [0x40febc], 1
mov dword [0x40fec0], 1
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x30]
mov dword [0x40febc], ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
jne 0x402314
xor eax, eax
jmp 0x402476
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x1c], 0
jmp 0x40232d
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 0x20
jge 0x402460
mov eax, 1
mov ecx, dword [ebp - 0x1c]
shl eax, cl
and eax, dword [ebp - 0x20]
jne 0x402348
jmp 0x402324
mov edx, 1
mov ecx, dword [ebp - 0x1c]
shl edx, cl
push edx
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
test eax, eax
jne 0x402368
xor eax, eax
jmp 0x402476
mov eax, 1
cpuid
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x18]
shr ecx, 8
and ecx, 0xf
mov edx, dword [ebp - 0x18]
shr edx, 0x14
and edx, 0xff
add ecx, edx
mov dword [0x40feb8], ecx
mov eax, dword [ebp - 0x10]
shr eax, 0x1c
and eax, 1
jne 0x4023ca
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x14], 0
mov edx, dword [ebp - 0x1c]
mov al, byte [ebp - 0x14]
mov byte [edx + 0x40fec4], al
mov ecx, dword [ebp - 0x1c]
mov dl, byte [ebp - 0x4c]
mov byte [ecx + 0x40fee4], dl
jmp 0x402324
mov eax, dword [ebp - 4]
shr eax, 0x18
and eax, 0xff
mov dword [ebp - 8], eax
cmp dword [0x40feb8], 0x10
jl 0x4023f8
mov ecx, dword [ebp - 8]
and ecx, 3
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
sar edx, 2
and edx, 0x3f
mov dword [ebp - 0x4c], edx
jmp 0x40240c
mov eax, dword [ebp - 8]
and eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
sar ecx, 1
and ecx, 7
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0x1c]
mov al, byte [ebp - 0x14]
mov byte [edx + 0x40fec4], al
mov ecx, dword [ebp - 0x1c]
mov dl, byte [ebp - 0x4c]
mov byte [ecx + 0x40fee4], dl
cmp dword [ebp - 8], 0
jne 0x402432
mov al, byte [ebp - 0x1c]
mov byte [0x40ff04], al
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x4c]
je 0x40245b
mov edx, dword [0x40fec0]
add edx, 1
mov dword [0x40fec0], edx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x4c]
mov dl, byte [ebp - 0x1c]
mov byte [ecx + 0x40ff04], dl
jmp 0x402324
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402480
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x410350]
mov dword [ebp - 4], eax
push ebx
mov eax, 0
cpuid
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], edx
push 4
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x14]
push ecx
call fcn.00403ed0
add esp, 0xc
push 4
lea edx, [ebp - 0x40]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.00403ed0
add esp, 0xc
push 4
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 0xc]
push edx
call fcn.00403ed0
add esp, 0xc
mov byte [ebp - 8], 0
lea eax, [ebp - 0x14]
push eax
push 0x40c28c
call fcn.004038f0
add esp, 8
test eax, eax
je 0x4024f5
xor eax, eax
jmp 0x402656
push 0x40c29c
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00402f00
add esp, 8
test eax, eax
jne 0x402541
push 4
lea edx, [ebp - 0x48]
push edx
push 0x40c2a0
push 0x40c2b0
push 0x80000001
call fcn.00402180
add esp, 0x14
push 0
push 0
push 2
mov eax, dword [ebp - 0x48]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 1
jmp 0x402656
push str.AMD_Dual_Core_Optimizer_Single_Instance
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x411140], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xb7
jne 0x40256e
xor eax, eax
jmp 0x402656
push 0x64
push 0x410e68
push 0x67
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x64
push 0x4110d8
push 0x6d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
mov eax, dword [ebp + 8]
push eax
call fcn.00402670
add esp, 4
push 0
push 0
call fcn.00403100
add esp, 8
test eax, eax
jne 0x4025ba
mov eax, 1
jmp 0x402656
push 4
push 0x4110d0
push 0x40c2f0
push 0x40c2fc
push 0x80000001
call fcn.00402180
add esp, 0x14
cmp dword [0x4110d0], 0
je 0x4025ee
push 0x40c314
call fcn.004012f0
add esp, 4
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.004027a0
add esp, 8
test eax, eax
jne 0x402604
xor eax, eax
jmp 0x402656
push 0x6d
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
mov dword [ebp - 0x18], eax
push 0
push 0
push 0
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x402653
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_TranslateAcceleratorA]
test eax, eax
jne 0x402651
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x402613
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 4]
call fcn.004039a9
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4027a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x410350]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [0x410ecc], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x410e68
push 0x4110d8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4027f8
xor eax, eax
jmp 0x4029cc
push 4
lea edx, [ebp - 4]
push edx
push 4
push str.window_handle
push 0x40c338
push 0x80000001
call fcn.004021f0
add esp, 0x18
mov dword [ebp - 0xa8], 0x9c
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor ecx, ecx
cmp dword [ebp - 0xa4], 6
sete cl
mov dword [0x411144], ecx
cmp dword [0x411144], 0
je 0x4028c0
push str.User32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x41113c], eax
cmp dword [0x41113c], 0
jne 0x402869
xor eax, eax
jmp 0x4029cc
push str.RegisterPowerSettingNotification
mov edx, dword [0x41113c]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x410ed0], eax
push str.UnregisterPowerSettingNotification
mov eax, dword [0x41113c]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x410e60], eax
cmp dword [0x410ed0], 0
je 0x4028a8
cmp dword [0x410e60], 0
jne 0x4028af
xor eax, eax
jmp 0x4029cc
push 0
push 0x40c4b0
mov ecx, dword [ebp - 4]
push ecx
call dword [0x410ed0]
push 0
mov edx, dword [ebp - 4]
push edx
call sub.WTSAPI32.dll_WTSRegisterSessionNotification
push 0x1f8
push 0
push 0x410ed8
call fcn.004039c0
add esp, 0xc
push str.Shell32.dll
call fcn.004026f0
add esp, 4
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], edx
cmp dword [ebp - 0xac], 0x50000
jb 0x40291b
ja 0x40290f
cmp dword [ebp - 0xb0], 0
jb 0x40291b
mov dword [0x410ed8], 0x1f8
jmp 0x402925
mov dword [0x410ed8], 0x1e8
mov dword [0x410ee0], 0
mov dword [0x410ee4], 7
push 0
push 0x32
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 1
push 0x6b
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [0x410eec], eax
mov ecx, dword [ebp - 4]
mov dword [0x410edc], ecx
mov dword [0x410ee8], 0x8000
push 0x80
push 0x40c3dc
push 0x410ef0
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x410ed8
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
cmp dword [0x410eec], 0
je 0x4029b9
mov edx, dword [0x410eec]
push edx
call dword [sym.imp.USER32.dll_DestroyIcon]
test eax, eax
je 0x4029b9
mov dword [0x410eec], 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
mov ecx, dword [ebp - 8]
call fcn.004039a9
mov esp, ebp
pop ebp
ret
Function at 0x403100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [0x41114c], 0
mov dword [0x411150], 0
mov dword [0x411154], 0
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004011f0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4031ca
cmp dword [ebp - 8], 0
je 0x4031ca
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x41114c], eax
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x411154], eax
cmp dword [0x41114c], 0
je 0x4031ca
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x403260
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x411150], eax
cmp dword [0x411150], 0
jne 0x4031ae
call fcn.004031f0
push 0xffffffffffffffff
mov ecx, dword [0x411154]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x411154]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], 0
je 0x4031df
cmp dword [ebp - 8], 0
je 0x4031df
mov dword [ebp - 0x10], 1
jmp 0x4031e6
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x404910
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x40c510
call fcn.00404c9c
mov edi, 0x94
mov eax, edi
call fcn.004080a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x411180], ecx
mov eax, dword [esi + 4]
mov dword [0x41118c], eax
mov edx, dword [esi + 8]
mov dword [0x411190], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x411184], esi
cmp ecx, 2
je 0x404970
or esi, 0x8000
mov dword [0x411184], esi
shl eax, 8
add eax, edx
mov dword [0x411188], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x4049ab
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4049ab
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4049c3
cmp eax, 0x20b
je 0x4049b0
mov dword [ebp - 0x1c], esi
jmp 0x4049d7
cmp dword [ecx + 0x84], 0xe
jbe 0x4049ab
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x4049d1
cmp dword [ecx + 0x74], 0xe
jbe 0x4049ab
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00408047
pop ecx
test eax, eax
jne 0x404a03
cmp dword [0x41116c], 1
jne 0x4049f0
call fcn.004079a7
push 0x1c
call fcn.00407830
push 0xff
call fcn.00406202
pop ecx
pop ecx
call fcn.00407fa5
mov dword [ebp - 4], esi
call fcn.004064d1
test eax, eax
jge 0x404a1c
push 0x1b
call fcn.004048eb
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x411914], eax
call fcn.00407e83
mov dword [0x411164], eax
call fcn.00407de1
test eax, eax
jge 0x404a42
push 8
call fcn.004048eb
pop ecx
call fcn.00407bae
test eax, eax
jge 0x404a53
push 9
call fcn.004048eb
pop ecx
push 1
call fcn.00406232
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x404a69
push eax
call fcn.004048eb
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00407b51
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x404a8a
movzx eax, word [ebp - 0x40]
jmp 0x404a8d
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00402480
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x404aab
push edi
call fcn.0040635d
call fcn.0040637f
jmp 0x404add
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00404cd7
ret

Function at 0x4061be
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4061de
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004077d1
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4061ff
test byte [esp + 8], 2
je 0x4061ff
mov dword [0x411174], 0xd
mov dword [0x411178], 5
jmp 0x4061da
xor eax, eax
ret
Function at 0x40629c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x4111c0], esi
push edi
jne 0x4062bc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x4111bc], esi
mov byte [0x4111b8], al
jne 0x406322
mov ecx, dword [0x411908]
test ecx, ecx
je 0x406303
mov eax, dword [0x411904]
sub eax, 4
cmp eax, ecx
jmp 0x4062fc
mov eax, dword [eax]
test eax, eax
je 0x4062ee
call eax
mov eax, dword [0x411904]
sub eax, 4
cmp eax, dword [0x411908]
mov dword [0x411904], eax
jae 0x4062e6
mov eax, 0x40f030
mov esi, 0x40f038
cmp eax, esi
mov edi, eax
jae 0x406322
mov eax, dword [edi]
test eax, eax
je 0x40631b
call eax
add edi, 4
cmp edi, esi
jb 0x406313
mov eax, 0x40f03c
mov esi, 0x40f044
cmp eax, esi
mov edi, eax
jae 0x406341
mov eax, dword [edi]
test eax, eax
je 0x40633a
call eax
add edi, 4
cmp edi, esi
jb 0x406332
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x40635b
push dword [ebp + 8]
mov dword [0x4111c0], 1
call fcn.00406202
pop ebp
ret

Function at 0x40667c
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
and dword [ebp - 0x18], 0
push esi
or esi, 0xffffffff
mov dword [eax + 4], esi
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
and eax, 0x80
push 0
mov dword [ebp - 0xc], eax
pop eax
push dword [ebp + 0xc]
sete al
mov dword [ebp - 0x1c], 0xc
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x4066da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004077d1
pop ecx
mov eax, esi
jmp 0x40679d
push ebx
push edi
call fcn.004045ea
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x4067a7
mov ecx, eax
mov esi, eax
sar ecx, 5
lea edi, [ecx*4 + 0x411800]
mov eax, dword [edi]
and esi, 0x1f
shl esi, 3
mov byte [esi + eax + 4], 0x89
call fcn.004045ea
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4067a0
sar eax, 5
lea ecx, [eax*4 + 0x411800]
mov edx, dword [ecx]
mov eax, ebx
and eax, 0x1f
shl eax, 3
mov byte [eax + edx + 4], 0x89
mov edx, 0x8000
test dword [ebp + 0x10], edx
jne 0x406748
test byte [ebp + 0x11], 0x40
jne 0x40675a
cmp dword [0x41134c], edx
jne 0x40675a
mov edx, dword [edi]
lea edx, [esi + edx + 4]
and byte [edx], 0x7f
mov edx, dword [ecx]
lea edx, [eax + edx + 4]
and byte [edx], 0x7f
cmp dword [ebp - 0xc], 0
je 0x406772
mov edx, dword [edi]
lea edx, [esi + edx + 4]
or byte [edx], 0x10
mov ecx, dword [ecx]
lea eax, [eax + ecx + 4]
or byte [eax], 0x10
push dword [ebp - 4]
mov esi, dword [ebp - 0x10]
push esi
call fcn.00404687
push dword [ebp - 8]
push ebx
call fcn.00404687
mov eax, dword [ebp + 8]
and dword [0x411174], 0
add esp, 0x10
mov dword [eax], esi
mov dword [eax + 4], ebx
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret
mov eax, dword [edi]
mov byte [esi + eax + 4], 0
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x411174], 0x18
call esi
push dword [ebp - 8]
call esi
and dword [0x411178], 0
or eax, 0xffffffff
jmp 0x40679b
Function at 0x407830
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x410350]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x410860]
je 0x407865
inc eax
cmp eax, 0x13
jb 0x407856
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x410860]
jne 0x40798b
mov eax, dword [0x41116c]
cmp eax, 1
je 0x407963
cmp eax, edx
jne 0x407895
cmp dword [0x4105e4], 1
je 0x407963
cmp ecx, 0xfc
je 0x40798b
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4078cb
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.00404e00
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00404860
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4078ff
mov eax, edi
push eax
call fcn.00404860
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x40c554
push edi
call fcn.004081e0
add esp, 0x10
push edi
call fcn.00404860
push dword [esi + 0x410864]
mov ebx, eax
call fcn.00404860
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.004080a0
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.00404e00
push edi
push ebx
call fcn.00404e10
push 0x40c550
push ebx
call fcn.00404e10
push dword [esi + 0x410864]
push ebx
call fcn.00404e10
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.004080dd
add esp, 0x2c
jmp 0x40798b
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x410864]
push dword [esi]
call fcn.00404860
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.004039a9
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret