joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x419580
push 0x406180
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
mov eax, dword [0x41b010]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
push 0x94
push 0
lea eax, [ebp - 0xb0]
push eax
call fcn.00406100
add esp, 0xc
mov dword [ebp - 0xb0], 0x94
lea ecx, [ebp - 0xb0]
push ecx
call dword [section..rdata]
mov eax, dword [ebp - 0xac]
cmp eax, 5
ja 0x40124c
jne 0x4012aa
cmp dword [ebp - 0xa8], 1
jb 0x4012aa
push str.kernel32
call dword [0x414008]
mov esi, eax
push str.ReleaseActCtx
push esi
mov edi, dword [0x414004]
call edi
mov ebx, eax
push str.DeactivateActCtx
push esi
call edi
test ebx, ebx
je 0x4012aa
test eax, eax
je 0x4012aa
mov dword [ebp - 4], 0
mov edx, dword [0x41c020]
push edx
push 0
call eax
mov eax, dword [section..data]
cmp eax, 0xffffffff
je 0x4012a3
push eax
call ebx
jmp 0x4012a3
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004060ed
mov esp, ebp
pop ebp
ret

Function at 0x4013d0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
sub esp, 0x64
push esi
push 1
xor esi, esi
push 0x16
mov dword [esp + 0xc], esi
call fcn.00406a4e
push 1
push 2
call fcn.00406a4e
push 1
push 0xf
call fcn.00406a4e
push 1
push 0x15
call fcn.00406a4e
add esp, 0x20
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0xc], 0xc
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 1
call dword [0x414024]
mov ecx, 1
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x50], 0x101
mov word [esp + 0x54], cx
call fcn.0040679b
push eax
call fcn.0040d885
push eax
call fcn.004064d3
mov dword [esp + 0x64], eax
call fcn.0040679b
add eax, 0x20
push eax
call fcn.0040d885
push eax
call fcn.004064d3
mov dword [esp + 0x70], eax
call fcn.0040679b
add eax, 0x40
push eax
call fcn.0040d885
push eax
call fcn.004064d3
add esp, 0x18
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x68], eax
lea eax, [esp + 0x28]
push eax
push esi
push esi
push esi
push 1
push esi
lea ecx, [esp + 0x24]
push ecx
call dword [0x414020]
mov edx, dword [esp + 0x8c]
push eax
push edx
call dword [0x41401c]
pop esi
test eax, eax
je 0x4014d8
mov eax, dword [esp + 0x10]
push 0xffffffffffffffff
push eax
call dword [0x414018]
mov edx, dword [esp + 0x10]
lea ecx, [esp]
push ecx
push edx
call dword [0x414014]
mov eax, dword [esp]
add esp, 0x64
ret
push str.Error_creating_child_process__n
call fcn.0040630f
add esp, 4
or eax, 0xffffffff
add esp, 0x64
ret
Function at 0x401860
Capabilities:
Get common file path

Disassembly:
sub esp, 0x14
mov eax, dword [0x41b010]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x24]
push edi
push 0x104
call dword [0x414028]
call fcn.004135f8
push eax
lea eax, [esp + 0x10]
push str._MEI_d
push eax
call fcn.0040781f
add esp, 0xc
xor ebx, ebx
jmp 0x4018a0
lea ecx, [esp + 0xc]
push ecx
push edi
call fcn.004075b4
mov esi, eax
push esi
call fcn.004135c6
add esp, 0xc
test eax, eax
je 0x4018dd
push esi
call fcn.00406e31
inc ebx
add esp, 4
cmp ebx, 5
jl 0x4018a0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.004060ed
add esp, 0x14
ret
mov edx, edi
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4018e3
dec edi
mov edi, edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4018f0
mov dx, word [0x4142cc]
push esi
mov word [edi], dx
call fcn.00406e31
mov ecx, dword [esp + 0x20]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.004060ed
add esp, 0x14
ret

Function at 0x401a10
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
mov ecx, dword [esi]
push 0
add eax, 0xffffffe8
push eax
push ecx
call fcn.00407d1d
add esp, 0xc
test eax, eax
je 0x401a33
or eax, 0xffffffff
pop esi
ret
mov edx, dword [esi]
push edi
push edx
push 1
lea edi, [esi + 0x10]
push 0x18
push edi
call fcn.00407c76
add esp, 0x10
cmp eax, 1
jae 0x401a52
pop edi
or eax, 0xffffffff
pop esi
ret
push 8
push str.MEI_f_v_n_v
push edi
call fcn.0040796c
add esp, 0xc
neg eax
pop edi
sbb eax, eax
pop esi
ret

Function at 0x401a70
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
push 0
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.00407d1d
mov ecx, dword [esi]
push ecx
push 2
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00407c76
mov ax, word [esp + 0x20]
add esp, 0x1c
cmp al, 0x4d
jne 0x401b43
cmp ah, 0x5a
jne 0x401b43
mov eax, dword [esi]
push 0
push 0x3c
push eax
call fcn.00407d1d
mov ecx, dword [esi]
push ecx
push 1
lea edx, [esp + 0x1c]
push 4
push edx
call fcn.00407c76
mov eax, dword [esp + 0x24]
mov ecx, dword [esi]
push 0
add eax, 0x18
push eax
push ecx
call fcn.00407d1d
mov edx, dword [esi]
push edx
push 1
lea eax, [esp + 0x34]
push 2
push eax
call fcn.00407c76
mov ax, word [esp + 0x3c]
add esp, 0x38
cmp al, 0xb
jne 0x401b43
cmp ah, 1
jne 0x401b0e
mov eax, 0x98
jmp 0x401b18
cmp ah, 2
jne 0x401b43
mov eax, 0xa8
add eax, dword [esp + 8]
mov edx, dword [esi]
push 0
push eax
push edx
call fcn.00407d1d
mov eax, dword [esi]
push eax
push 1
lea ecx, [esp + 0x1c]
push 4
push ecx
call fcn.00407c76
mov eax, dword [esp + 0x24]
add esp, 0x1c
test eax, eax
jne 0x401b46
or eax, 0xffffffff
pop esi
add esp, 8
ret
Function at 0x401b50
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
lea eax, [esi + 0x28]
push 0x414334
push eax
call fcn.00408132
add esp, 8
mov dword [esi], eax
test eax, eax
jne 0x401b71
or eax, 0xffffffff
pop esi
ret
push edi
push 2
push 0
push eax
call fcn.00407d1d
mov ecx, dword [esi]
push ecx
call fcn.00408011
mov edi, eax
push edi
push esi
call fcn.00401a10
add esp, 0x18
test eax, eax
jns 0x401bcf
push esi
call fcn.00401a70
mov edi, eax
add esp, 4
cmp edi, 1
jl 0x401c81
push ebx
xor ebx, ebx
jmp 0x401bb0
push edi
push esi
call fcn.00401a10
add esp, 8
test eax, eax
jns 0x401bc5
inc ebx
dec edi
cmp ebx, 8
jl 0x401bb0
cmp ebx, 8
pop ebx
je 0x401c81
mov edx, dword [esi + 0x18]
push edx
call fcn.004060b8
sub edi, eax
mov eax, dword [esi + 0x1c]
push 0
push eax
mov dword [esi + 4], edi
call fcn.004060b8
add eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
call fcn.00407d1d
mov edx, dword [esi + 0x20]
add esp, 0xc
push edx
call fcn.004060b8
push eax
call fcn.00407de9
add esp, 4
mov dword [esi + 8], eax
test eax, eax
jne 0x401c23
push str.Could_not_allocate_buffer_for_TOC.
call fcn.0040630f
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi]
mov ecx, dword [esi + 0x20]
push eax
push 1
push ecx
call fcn.004060b8
mov edx, dword [esi + 8]
push eax
push edx
call fcn.00407c76
add esp, 0x10
cmp eax, 1
jae 0x401c56
push str.Could_not_read_from_file.
call fcn.0040630f
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esi + 0x20]
push eax
call fcn.004060b8
add eax, dword [esi + 8]
mov ecx, dword [esi]
push ecx
mov dword [esi + 0xc], eax
call fcn.00407dc1
add esp, 4
test eax, eax
je 0x401c87
push str.Error_on_file
call fcn.0040630f
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x402930
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 4]
push esi
push edi
push 0
push eax
call fcn.004060b8
mov edi, dword [esp + 0x14]
add eax, dword [edi + 4]
mov ecx, dword [edi]
push eax
push ecx
call fcn.00407d1d
mov edx, dword [ebp + 8]
add esp, 0xc
push edx
call fcn.004060b8
push eax
call fcn.00407de9
mov esi, eax
add esp, 4
test esi, esi
jne 0x402980
push str.Could_not_allocate_read_buffer_n
call fcn.0040630f
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
push eax
push 1
push ecx
call fcn.004060b8
push eax
push esi
call fcn.00407c76
add esp, 0x10
cmp eax, 1
jae 0x4029b0
push str.Could_not_read_from_file_n
call fcn.0040630f
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebp
ret
cmp byte [ebp + 0x10], 2
jne 0x402aa0
mov eax, dword [0x41c2d8]
test eax, eax
jne 0x4029d6
push 0x414e1c
call dword [0x41c270]
add esp, 4
mov dword [0x41c2d8], eax
push ebx
push eax
call dword [0x41c298]
mov edi, eax
push 0x414e18
push edi
call dword [0x41c29c]
push str.block_size
push edi
mov dword [esp + 0x28], eax
call dword [0x41c29c]
push eax
call dword [0x41c2d0]
mov ebx, eax
push ebx
call fcn.00407de9
push ebx
push 0
push eax
mov dword [esp + 0x40], eax
call fcn.00406100
mov edx, dword [esp + 0x40]
add esp, 0x28
push ebx
push edx
push str.MODE_CFB
push edi
call dword [0x41c29c]
add esp, 8
push eax
mov eax, dword [esp + 0x20]
push 0x20
push esi
push str.sOs
push eax
call dword [0x41c294]
mov ecx, dword [ebp + 8]
add esp, 0x1c
push ecx
mov edi, eax
call fcn.004060b8
sub eax, 0x20
push eax
lea edx, [esi + 0x20]
push edx
push 0x414df4
push str.decrypt
push edi
call dword [0x41c2b0]
mov ebx, eax
mov eax, dword [ebp + 8]
add esp, 0x14
push eax
call fcn.004060b8
sub eax, 0x20
push eax
push ebx
call dword [0x41c290]
add esp, 4
push eax
push esi
call fcn.00408320
push edi
call dword [0x41c25c]
push ebx
call dword [0x41c25c]
add esp, 0x14
pop ebx
mov al, byte [ebp + 0x10]
cmp al, 1
je 0x402aab
cmp al, 2
jne 0x402ada
push ebp
push esi
call fcn.00402840
push esi
mov edi, eax
call fcn.00406e31
add esp, 0xc
mov esi, edi
test edi, edi
jne 0x402ada
add ebp, 0x12
push ebp
push str.Error_decompressing__s_n
call fcn.0040630f
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebp
ret
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x402cb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
push ebx
push edi
call fcn.00402930
add esp, 8
mov dword [esp + 8], eax
call fcn.00402c40
cmp eax, 0xffffffff
jne 0x402cd9
pop edi
or eax, eax
pop ebx
pop ecx
ret
push ebp
push esi
lea ebp, [ebx + 0x12]
push ebp
add edi, 0x232
push edi
call fcn.00402ae0
mov esi, eax
add esp, 8
test esi, esi
jne 0x402d0b
push ebp
push str._s_could_not_be_extracted__n
call fcn.0040630f
add esp, 8
pop esi
pop ebp
pop edi
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov eax, dword [ebx + 0xc]
push esi
push 1
push eax
call fcn.004060b8
mov edi, dword [esp + 0x18]
push eax
push edi
call fcn.00408976
push esi
call fcn.004087ab
push edi
call fcn.00406e31
add esp, 0x18
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x402df0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.00408aa0
mov eax, dword [0x41b010]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
push esi
push edi
push 0x414334
push eax
mov edi, ecx
mov ebx, edx
call fcn.00408132
push ebx
push edi
mov esi, eax
call fcn.00402ae0
add esp, 0x10
xor ebx, ebx
mov edi, eax
test esi, esi
je 0x402edd
test edi, edi
je 0x402edd
push esi
call fcn.00407d99
add esp, 4
test eax, eax
jne 0x402eb4
mov edi, edi
push esi
push 1
lea eax, [esp + 0x14]
push 0x1000
push eax
call fcn.00407c76
add esp, 0x10
cmp eax, 0xffffffff
jne 0x402e7a
push esi
call fcn.00407dc1
add esp, 4
test eax, eax
je 0x402e99
push esi
jmp 0x402ea9
push edi
push 1
lea ecx, [esp + 0x14]
push 0x1000
push ecx
call fcn.00408976
push edi
call fcn.00407dc1
add esp, 0x14
test eax, eax
jne 0x402ea8
push esi
call fcn.00407d99
add esp, 4
test eax, eax
je 0x402e50
jmp 0x402eb4
push edi
call fcn.00408a94
add esp, 4
or ebx, 0xffffffff
push esi
call fcn.004087ab
push edi
call fcn.004087ab
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004060ed
add esp, 0x1004
ret
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
or eax, 0xffffffff
call fcn.004060ed
add esp, 0x1004
ret
Function at 0x4060ed
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b010]
jne 0x4060f7
repz ret
jmp fcn.004090af

Function at 0x40ced3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40cefa
call fcn.0040a50f
mov dword [eax], esi
call fcn.0040a4fc
push 0x16
pop esi
mov dword [eax], esi
call fcn.0040a4aa
mov eax, esi
jmp 0x40cf4f
test dword [ebp + 0xc], 0xfffffff9
jne 0x40cee0
push dword [ebp + 8]
call dword [0x4140fc]
cmp eax, 0xffffffff
jne 0x40cf27
call dword [0x41402c]
push eax
call fcn.0040a522
pop ecx
call fcn.0040a4fc
mov eax, dword [eax]
jmp 0x40cf4f
test al, 0x10
jne 0x40cf4d
test al, 1
je 0x40cf4d
test byte [ebp + 0xc], 2
je 0x40cf4d
call fcn.0040a50f
mov dword [eax], 5
call fcn.0040a4fc
mov dword [eax], 0xd
jmp 0x40cf1e
xor eax, eax
pop esi
pop ebp
ret

Function at 0x411959
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040afe6
and dword [ebp - 0x14], 0
cmp dword [0x41cff8], 0
mov dword [ebp - 0x18], eax
jne 0x411a0c
push str.USER32.DLL
call dword [0x414144]
mov ebx, eax
test ebx, ebx
je 0x411ab4
mov edi, dword [0x414004]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x411ab4
mov esi, dword [0x414058]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41cff8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41cffc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41d000], eax
call edi
push eax
call esi
mov dword [0x41d008], eax
test eax, eax
je 0x411a0c
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41d004], eax
mov eax, dword [0x41d004]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x414054]
cmp eax, ecx
je 0x411a65
cmp dword [0x41d008], ecx
je 0x411a65
push eax
call esi
push dword [0x41d008]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x411a65
test ebx, ebx
je 0x411a65
call edi
test eax, eax
je 0x411a5c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x411a5c
test byte [ebp - 8], 1
jne 0x411a65
or dword [ebp + 0x10], 0x200000
jmp 0x411a98
mov eax, dword [0x41cffc]
cmp eax, dword [ebp - 0x18]
je 0x411a98
push eax
call esi
test eax, eax
je 0x411a98
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411a98
mov eax, dword [0x41d000]
cmp eax, dword [ebp - 0x18]
je 0x411a98
push eax
call esi
test eax, eax
je 0x411a98
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41cff8]
call esi
test eax, eax
je 0x411ab4
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411ab6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004060ed
leave
ret
Function at 0x4013ca
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x40604c], 1
mov dword [0x406050], 1
mov dword [0x406054], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40140b
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40142e
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401450
cmp eax, 0x20b
je 0x401475
jmp 0x4014a0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401462
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x40148d
mov eax, 0
jmp 0x4014a5
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4014a5
mov eax, 0
leave
ret

Function at 0x401670
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x5c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateProcessA]
call eax
sub esp, 0x28
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp + 4], eax
mov dword [esp], str._lu_n
call sym._printf
nop
leave
ret

Function at 0x401988
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x40255c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40257b
mov eax, 0
jmp 0x4025bf
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40259e
mov eax, 0
jmp 0x4025bf
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x4025ba
mov eax, 0
jmp 0x4025bf
mov eax, 1
leave
ret
Function at 0x4025c1
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x402620
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x402618
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x402618
mov eax, dword [ebp - 4]
jmp 0x402634
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x4025f5
mov eax, 0
leave
ret

Function at 0x57a2de
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
pushal
push ebp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add dl, dl
jne 0x57a2fb
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x57a2ec
add dl, dl
jne 0x57a306
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x57a352
xor eax, eax
add dl, dl
jne 0x57a313
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x57a3ef
add dl, dl
jne 0x57a322
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57a32d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57a338
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57a343
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x57a34d
push edi
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
jmp 0x57a2f2
mov eax, 1
add dl, dl
jne 0x57a360
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x57a36b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x57a357
sub eax, 2
jne 0x57a39a
mov ecx, 1
add dl, dl
jne 0x57a380
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x57a38b
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x57a377
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x57a2f2
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x57a3b1
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x57a3bc
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x57a3a8
cmp eax, 0x7d00
jae 0x57a3df
cmp eax, 0x500
jb 0x57a3da
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x57a2f2
cmp eax, 0x7f
ja 0x57a3e2
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x57a2f2
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x57a40b
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x57a2f2
pop ebp
sub edi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
popal
pop ebp
ret 8
Function at 0x40107a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x420490]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
mov byte [ebp - 0x31], bl
cmp esi, ebx
je 0x401169
lea eax, [ebp - 0x48]
push eax
call fcn.0040646d
pop ecx
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x30]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x38]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SoftwareGoogleBreakpadThrottling
push 0x80000001
mov dword [ebp - 0x3c], 0x28
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x401169
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push esi
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x4010fa
cmp eax, ebx
jne 0x401169
cmp eax, ebx
jne 0x401130
cmp dword [ebp - 0x3c], 0x28
jb 0x401169
xor edi, edi
xor edx, edx
mov ecx, dword [ebp - 0x48]
sub ecx, dword [ebp + edx*8 - 0x30]
mov eax, dword [ebp - 0x44]
sbb eax, dword [ebp + edx*8 - 0x2c]
cmp eax, ebx
jg 0x401125
jl 0x401124
cmp ecx, 0x15180
jae 0x401125
inc edi
inc edx
cmp edx, 5
jl 0x401108
cmp edi, 5
jge 0x401169
push 0x20
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004060b0
mov eax, dword [ebp - 0x48]
add esp, 0xc
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x44]
push 0x28
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x30]
push eax
push 3
push ebx
push esi
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x401169
mov byte [ebp - 0x31], 1
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x31]
pop edi
xor ecx, ebp
pop ebx
call fcn.00405f29
leave
ret