joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463721
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x480250]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00463660
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.00454a00
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x463770
cmp dword [ebp - 0x1c], 5
jb 0x463788
jmp 0x463784
cmp dword [ebp - 0x10], 1
jne 0x463788
cmp dword [ebp - 0x1c], 4
ja 0x463784
jne 0x463788
cmp dword [ebp - 0x18], 0
jbe 0x463788
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x46b890
call fcn.0041ab40
test eax, eax
jge 0x4637a9
mov byte [0x482f48], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044e7cc
add ebp, 0x78
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x432030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x1007af40
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100b6ff0
push 0x100979d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
cmp dword [ebp + 0xc], 1
jne 0x1007b033
push 0x20
push 0
push 0x100b8240
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp + 8]
mov dword [0x100b8258], eax
mov ecx, dword [0x100b8258]
mov dword [0x100b8228], ecx
mov dword [0x100b8240], 2
mov edx, dword [0x100b5290]
xor edx, dword [0x100b52a4]
xor edx, dword [0x100b52a8]
and edx, 0x40000
test edx, edx
je 0x1007b029
mov al, byte [0x100b8234]
mov byte [ebp - 0x58], al
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x57]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
lea ecx, [ebp - 0x58]
push ecx
push 0x100b5220
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1007aff9
lea edx, [ebp - 0x58]
push edx
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [0x100b846c], eax
push fcn.1007cb42
push 0x100b521c
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x58]
push ecx
push 0x100b5220
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, 1
jmp 0x1007b137
call fcn.1007cb42
jmp 0x1007b137
cmp dword [ebp + 0xc], 0
jne 0x1007b0ef
mov edx, dword [0x100b5290]
xor edx, dword [0x100b52a4]
xor edx, dword [0x100b52a8]
and edx, 0x40000
test edx, edx
je 0x1007b070
push 0
push 0x100b5220
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov eax, 1
jmp 0x1007b137
mov dword [ebp - 4], 0
mov dword [ebp - 0x5c], 1
cmp dword [0x100b825c], 0
je 0x1007b0bc
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [0x100b825c]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 4], 0
jmp 0x1007b0bc
call fcn.1007cb19
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64]
jmp 0x1007b137
mov dword [ebp - 0x60], 1
cmp dword [0x100b825c], 0
je 0x1007b134
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [0x100b825c]
mov dword [ebp - 0x60], eax
mov dword [ebp - 4], 0xffffffff
jmp 0x1007b134
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1007c094
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
add ecx, 0xf8
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add edx, dword [ecx + 0x20]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x24]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
jmp 0x1007c100
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx + 0x18]
jae 0x1007c14a
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x1007c148
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + eax*2]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x1007c14c
jmp 0x1007c0f7
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1007cb42
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0
push 0x100b5220
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
cmp dword [0x100b846c], 0
je 0x1007cb81
mov eax, dword [0x100b846c]
mov dword [ebp - 8], eax
mov dword [0x100b846c], 0
call dword [ebp - 8]
test eax, eax
jne 0x1007cb81
xor eax, eax
jmp 0x1007cc41
call fcn.1007ca70
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jne 0x1007cbcf
cmp dword [0x100b825c], 0
je 0x1007cbc8
push 0x100b8480
push 1
mov ecx, dword [0x100b8228]
push ecx
call dword [0x100b825c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1007cbc1
call fcn.1007cb19
xor eax, eax
jmp 0x1007cc41
mov eax, 1
jmp 0x1007cc41
mov eax, 1
jmp 0x1007cc41
cmp dword [ebp - 4], 0
jne 0x1007cc3f
call fcn.1007b171
push eax
lea edx, [ebp - 0x108]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
call fcn.1007b182
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
je 0x1007cc25
push 0x100b554c
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
call fcn.1007b182
push eax
lea ecx, [ebp - 0x108]
push ecx
call sub.MSVCRT.dll_strcat
add esp, 8
push 0x40010
push 0
lea edx, [ebp - 0x108]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x1007cc41
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1008d28e
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2cc
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call fcn.10088aef
add esp, 4
and eax, 0xff
test eax, eax
je 0x1008d317
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x2cc
push 0
lea eax, [ebp - 0x2cc]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x2cc], 0x10001
lea ecx, [ebp - 0x2cc]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1008d315
mov ecx, dword [ebp - 0x214]
cmp ecx, dword [ebp + 0xc]
jne 0x1008d315
jmp 0x1008d317
jmp 0x1008d297
mov esp, ebp
pop ebp
ret

Function at 0x1008d7ce
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
movsx eax, byte [0x100b8758]
test eax, eax
jne 0x1008d7e2
call fcn.1008d714
xor ecx, ecx
mov cl, byte [0x100b8755]
test ecx, ecx
jne 0x1008d869
xor edx, edx
mov dl, byte [0x100b8754]
test edx, edx
jne 0x1008d869
cmp dword [0x100b885c], 0
je 0x1008d844
mov eax, dword [ebp + 0xc]
push eax
push 0
push 0x180
mov ecx, dword [0x100b885c]
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebp - 4], eax
push 0
mov edx, dword [ebp - 4]
push edx
push 0x186
mov eax, dword [0x100b885c]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x100b885c]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
jmp 0x1008d869
push 0x10001
push 0x100b8758
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x1008d869
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esp, ebp
pop ebp
ret
Function at 0x1009084a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x1009085a
xor eax, eax
jmp 0x10090a23
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
mov dword [ebp + 8], eax
cmp dword [ebp + 0x10], 8
jb 0x100909db
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x100b7164]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x100b7164]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x100b7164]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x100b7164]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x100b7164]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x100b7164]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x100b7164]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 8]
xor eax, edx
and eax, 0xff
mov ecx, dword [ebp + 8]
shr ecx, 8
mov edx, dword [eax*4 + 0x100b7164]
xor edx, ecx
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
sub ecx, 8
mov dword [ebp + 0x10], ecx
jmp 0x10090863
cmp dword [ebp + 0x10], 0
je 0x10090a1d
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 8]
xor ecx, eax
and ecx, 0xff
mov edx, dword [ebp + 8]
shr edx, 8
mov eax, dword [ecx*4 + 0x100b7164]
xor eax, edx
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], 0
jne 0x100909e1
mov eax, dword [ebp + 8]
xor eax, 0xffffffff
pop ebp
ret
Function at 0x403b00
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov esi, dword [esp + 0xc]
test eax, eax
jne 0x403b17
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push esi
call edi
push 4
push esi
call edi
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push esi
call dword [sym.imp.USER32.dll_SetCapture]
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
push esi
call dword [sym.imp.USER32.dll_DrawFocusRect]
push esi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
movsx ecx, word [esp + 0x10]
movsx edx, word [esp + 0x14]
pop edi
mov dword [0x416adc], ecx
mov dword [0x416ae0], edx
mov eax, 1
pop esi
ret

Function at 0x405190
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
call fcn.00407150
mov eax, dword [0x416904]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 1
call fcn.004010c0
mov ecx, dword [esp + 0x10]
add esp, 4
push ecx
push 0x4051f0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov edx, dword [0x416900]
push eax
push str.Getbm
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
mov edi, eax
call fcn.004010c0
mov eax, dword [0x416904]
add esp, 4
push 4
push eax
call esi
mov eax, edi
pop edi
pop esi
ret

Function at 0x405490
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x416904]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
push 1
call fcn.004010c0
add esp, 4
push 0
push 0x4054f0
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ecx, dword [0x416900]
push eax
push str.DeleteWord
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 0
call fcn.004010c0
mov edx, dword [0x416904]
add esp, 4
push 4
push edx
call esi
pop esi
ret

Function at 0x405a40
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x10
mov eax, dword [0x416afc]
push ebx
mov dword [esp + 4], str.ssm.tp
mov dword [esp + 8], str.ssmft.tp
mov dword [esp + 0xc], str.ssme.tp
mov dword [esp + 0x10], str.ssmfte.tp
mov ecx, dword [esp + eax*4 + 4]
push ebp
push 0x4139d0
push ecx
call fcn.0040b0d0
mov ebp, eax
xor ebx, ebx
add esp, 8
cmp ebp, ebx
jne 0x405aa0
push 0x1000
push str.ERROR
push str.Can_not_open_TiaoPin_source_file
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
pop ebx
add esp, 0x10
ret
mov edx, dword [0x416afc]
push edi
push esi
push 0xa
push 0x41365e
push edx
call fcn.00411320
add esp, 0xc
push 0x416b28
push ebx
push str.Number0
push str.Option
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
mov dword [0x42630c], eax
mov ecx, 0x3a98
xor eax, eax
mov edi, 0x4178a0
rep stosd dword es:[edi], eax
xor esi, esi
lea edi, [esi + 0x4178a0]
push ebp
push 0x28
push edi
call fcn.0040b120
add esp, 0xc
test eax, eax
je 0x405b15
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add esi, 0x28
cmp esi, 0xea60
mov byte [ecx + esi + 0x417877], bl
jl 0x405ae3
push ebp
call fcn.0040b020
add esp, 4
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x405b30
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x416904]
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push eax
call esi
mov ecx, dword [0x416904]
mov edx, dword [0x416900]
push 0
push 0x405b70
push ecx
push str.ABOUT
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov eax, dword [0x416904]
push 4
push eax
call esi
pop esi
ret

Function at 0x406250
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x100
push ebx
push esi
mov esi, dword [esp + 0x10c]
push edi
mov edi, dword [sym.imp.USER32.dll_GetParent]
push esi
call edi
test eax, eax
je 0x40627a
cmp eax, esi
je 0x40627a
push eax
mov esi, eax
call edi
test eax, eax
jne 0x40626d
lea eax, [esp + 0xc]
push 0x100
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov al, byte [esp + 0xc]
mov byte [esp + 0x15], 0
test al, al
jne 0x4062a4
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x100
ret
mov esi, str.Microsoft
lea eax, [esp + 0xc]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x4062e6
test cl, cl
je 0x4062d1
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x4062e6
add eax, 2
add esi, 2
test cl, cl
jne 0x4062ad
xor eax, eax
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
pop edi
pop esi
pop ebx
add esp, 0x100
ret
sbb eax, eax
pop edi
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
pop esi
mov eax, ecx
pop ebx
add esp, 0x100
ret

Function at 0x40aff0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x40b007
call dword [sym.imp.kernel32.dll_GetLastError]
jmp 0x40b009
xor eax, eax
test eax, eax
je 0x40b01a
push eax
call fcn.0040d540
add esp, 4
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x40b600
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push section..rdata
push 0x40ef38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.kernel32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x4309e0], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x4309dc], ecx
shl ecx, 8
add ecx, edx
mov dword [0x4309d8], ecx
shr eax, 0x10
mov dword [0x4309d4], eax
call fcn.0040cd10
test eax, eax
jne 0x40b66a
push 0x1c
call fcn.0040b7a0
add esp, 4
mov dword [ebp - 4], 0
call fcn.0040e270
call fcn.0040ee30
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x431dd4], eax
call fcn.0040ea00
mov dword [0x4308c8], eax
test eax, eax
je 0x40b69d
mov eax, dword [0x431dd4]
test eax, eax
jne 0x40b6a7
push 0xffffffffffffffff
call fcn.0040def0
add esp, 4
call fcn.0040e750
call fcn.0040e660
call fcn.0040dec0
mov esi, dword [0x431dd4]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x40b786
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x40b6ee
test al, al
je 0x40b6ee
and eax, 0xff
push eax
call fcn.0040e600
add esp, 4
test eax, eax
je 0x40b6c8
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40b6c8
cmp byte [esi], 0x22
jne 0x40b6f7
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x40b707
cmp al, 0x20
ja 0x40b707
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40b6f7
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40b728
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x40b72d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.0040def0
jmp 0x40b76b
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40b6f7
inc esi
mov dword [ebp - 0x64], esi
jmp 0x40b786
Function at 0x40df30
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x430a10]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x40df4f
push ebp
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x430a0c], 1
mov byte [0x430a08], bl
jne 0x40dfa9
mov ecx, dword [0x431dc8]
test ecx, ecx
je 0x40df97
mov esi, dword [0x431dc4]
sub esi, 4
cmp esi, ecx
jb 0x40df97
mov eax, dword [esi]
test eax, eax
je 0x40df90
call eax
mov ecx, dword [0x431dc8]
sub esi, 4
cmp esi, ecx
jae 0x40df82
push 0x41301c
push 0x413014
call fcn.0040dfe0
add esp, 8
push 0x413024
push 0x413020
call fcn.0040dfe0
add esp, 8
test ebx, ebx
jne 0x40dfd0
push ebp
mov dword [0x430a10], 1
call dword [sym.imp.kernel32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret
Function at 0x40e270
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x48
push ebx
push ebp
push esi
push edi
push 0x100
call fcn.0040af40
mov esi, eax
add esp, 4
test esi, esi
jne 0x40e294
push 0x1b
call fcn.0040b7a0
add esp, 4
lea eax, [esi + 0x100]
mov dword [0x431cc0], esi
cmp esi, eax
mov dword [0x431dc0], 0x20
mov bl, 0xa
jae 0x40e2d0
mov byte [esi + 4], 0
mov dword [esi], 0xffffffff
mov byte [esi + 5], bl
mov ecx, dword [0x431cc0]
add esi, 8
add ecx, 0x100
cmp esi, ecx
jb 0x40e2b0
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
cmp word [esp + 0x46], 0
je 0x40e3d9
mov eax, dword [esp + 0x48]
test eax, eax
je 0x40e3d9
mov ecx, dword [eax]
lea edi, [eax + 4]
cmp ecx, 0x800
mov dword [esp + 0x10], ecx
lea ebp, [edi + ecx]
jl 0x40e30f
mov dword [esp + 0x10], 0x800
mov eax, dword [esp + 0x10]
mov ecx, dword [0x431dc0]
cmp ecx, eax
jge 0x40e386
mov esi, 0x431cc4
push 0x100
call fcn.0040af40
add esp, 4
test eax, eax
je 0x40e37c
mov ecx, dword [0x431dc0]
mov dword [esi], eax
add ecx, 0x20
mov dword [0x431dc0], ecx
lea ecx, [eax + 0x100]
cmp eax, ecx
jae 0x40e36a
mov byte [eax + 4], 0
mov dword [eax], 0xffffffff
mov byte [eax + 5], bl
mov edx, dword [esi]
add eax, 8
add edx, 0x100
cmp eax, edx
jb 0x40e34e
mov eax, dword [0x431dc0]
mov ecx, dword [esp + 0x10]
add esi, 4
cmp eax, ecx
jl 0x40e322
jmp 0x40e386
mov ecx, dword [0x431dc0]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
xor esi, esi
test eax, eax
jle 0x40e3d9
mov ecx, dword [ebp]
cmp ecx, 0xffffffff
je 0x40e3cc
mov al, byte [edi]
test al, 1
je 0x40e3cc
test al, 8
jne 0x40e3ad
push ecx
call dword [sym.imp.kernel32.dll_GetFileType]
test eax, eax
je 0x40e3cc
mov edx, esi
mov eax, esi
sar edx, 5
and eax, 0x1f
mov ecx, dword [edx*4 + 0x431cc0]
mov edx, dword [ebp]
mov dword [ecx + eax*8], edx
lea eax, [ecx + eax*8]
mov cl, byte [edi]
mov byte [eax + 4], cl
mov eax, dword [esp + 0x10]
inc esi
inc edi
add ebp, 4
cmp esi, eax
jl 0x40e390
mov ebp, dword [sym.imp.kernel32.dll_GetStdHandle]
xor ebx, ebx
mov edx, dword [0x431cc0]
mov eax, dword [edx + ebx*8]
lea esi, [edx + ebx*8]
cmp eax, 0xffffffff
jne 0x40e446
test ebx, ebx
mov byte [esi + 4], 0x81
jne 0x40e401
mov eax, 0xfffffff6
jmp 0x40e40b
mov eax, ebx
dec eax
neg eax
sbb eax, eax
add eax, 0xfffffff5
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
je 0x40e43f
push edi
call dword [sym.imp.kernel32.dll_GetFileType]
test eax, eax
je 0x40e43f
and eax, 0xff
mov dword [esi], edi
cmp eax, 2
jne 0x40e433
mov al, byte [esi + 4]
or al, 0x40
jmp 0x40e44b
cmp eax, 3
jne 0x40e44e
mov al, byte [esi + 4]
or al, 8
jmp 0x40e44b
mov al, byte [esi + 4]
or al, 0x40
jmp 0x40e44b
mov al, byte [esi + 4]
or al, 0x80
mov byte [esi + 4], al
inc ebx
cmp ebx, 3
jl 0x40e3e1
mov eax, dword [0x431dc0]
push eax
call dword [sym.imp.kernel32.dll_LockResource]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x48
ret