joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b8c0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x38]
push edi
push eax
push esi
xor edi, edi
mov byte [ebp - 1], 1
call fcn.00441fa2
add esp, 8
test eax, eax
jne 0x43b90e
push 0x4842f8
push esi
call fcn.00440d02
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x43b918
push esi
push str.ERROR:_Unable_to_open__s_for_reading_n
call fcn.00442857
mov eax, dword [ebp + 0x10]
add esp, 8
test eax, eax
je 0x43b90e
mov dword [eax], edi
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x14
cmp byte [ebp + 0x18], 0
push ebx
je 0x43b97f
cmp byte [ebp + 0x14], 0
mov eax, dword [ebp - 0x24]
je 0x43b93c
mov dword [ebp + 0x14], eax
inc eax
push eax
call fcn.0043e4b6
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ebp + 0x14]
jmp 0x43b94b
inc eax
push eax
call fcn.0043d6b0
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebx]
add esp, 4
test ecx, ecx
je 0x43b96f
mov byte [ecx + eax], 0
mov eax, dword [ebx]
mov dword [ebp + 0x14], eax
test eax, eax
jne 0x43b97a
push esi
push str.Unable_to_allocate_memory_to_read__s_to_mem
call fcn.00442857
add esp, 8
pop ebx
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp - 0x24]
jmp 0x43b9aa
cmp byte [ebp + 0x14], 0
je 0x43b990
mov esi, dword [ebp - 0x24]
push esi
call fcn.0043e4b6
jmp 0x43b99b
push dword [ebp - 0x24]
call fcn.0043d6b0
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp + 0xc]
add esp, 4
mov dword [ebp + 0x14], eax
mov dword [ebx], eax
test eax, eax
je 0x43b96f
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x43b9b3
mov dword [ecx], esi
test esi, esi
je 0x43ba28
mov ecx, 0x8000
lea esp, [esp]
push dword [ebp - 8]
sub esi, edi
cmp esi, 0x8000
cmova esi, ecx
push esi
push 1
push eax
call fcn.00440edc
mov ecx, eax
add esp, 0x10
cmp ecx, esi
jne 0x43b9f8
mov eax, dword [ebp + 0x14]
add edi, ecx
mov esi, dword [ebp - 0x24]
add eax, ecx
mov dword [ebp + 0x14], eax
mov ecx, 0x8000
cmp edi, esi
jb 0x43b9c0
jmp 0x43ba28
push dword [ebp + 8]
push edi
push esi
push str.Unable_to_read__li_bytes_at_offset__li_from_file__s_n
call fcn.00442857
push dword [ebx]
call fcn.0043e094
mov eax, dword [ebp + 0x10]
add esp, 0x14
mov dword [ebx], 0
test eax, eax
je 0x43ba24
mov dword [eax], 0
mov byte [ebp - 1], 0
push dword [ebp - 8]
call fcn.00441615
mov al, byte [ebp - 1]
add esp, 4
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x43cee0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43cef7
xor al, al
pop ebp
ret 4
shr al, 4
and al, 1
pop ebp
ret 4
Function at 0x43cf00
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
mov edx, edi
mov dword [ebp - 4], ebx
lea esi, [edx + 1]
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x43cf20
sub edx, esi
cmp edx, 0x104
jae 0x43d108
cmp byte [ebp + 0xc], al
je 0x43cf52
push 0x104
lea eax, [ebp - 0x23c]
push eax
push edi
call fcn.0043d140
lea edi, [ebp - 0x23c]
lea eax, [ebp - 0x34]
push eax
push edi
call fcn.00441fa2
add esp, 8
test eax, eax
jne 0x43cf77
test dword [ebp - 0x2e], 0x4000
je 0x43cf77
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
lea edx, [ebp - 0x138]
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x43cf81
lea eax, [ebp - 0x138]
push 0x5c
push eax
call fcn.0043f2d0
mov esi, eax
add esp, 8
test esi, esi
je 0x43d0d9
mov ecx, esi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43cfb0
sub ecx, edx
cmp ecx, 3
jbe 0x43cffe
cmp byte [esi + 1], 0x5c
jne 0x43cffe
lea eax, [esi + 2]
push 0x5c
push eax
call fcn.0043f2d0
add esp, 8
test eax, eax
je 0x43d0d9
inc eax
push 0x5c
push eax
call fcn.0043f2d0
add esp, 8
test eax, eax
je 0x43d0d9
inc eax
push 0x5c
push eax
call fcn.0043f2d0
add esp, 8
mov esi, eax
jmp 0x43d040
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d003
sub ecx, edx
lea edx, [ebp - 0x138]
lea ebx, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x43d015
sub edx, ebx
cmp ecx, edx
je 0x43d03d
mov al, byte [esi - 1]
cmp al, 0x3a
je 0x43d02d
cmp al, 0x5c
jne 0x43d03d
lea eax, [esi + 1]
push 0x5c
push eax
call fcn.0043f2d0
add esp, 8
mov esi, eax
mov ebx, dword [ebp - 4]
test esi, esi
je 0x43d0d9
jmp 0x43d050
lea ecx, [ebp - 0x138]
mov byte [esi], 0
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x43d060
sub ecx, edx
je 0x43d0be
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x138]
push eax
call fcn.00441fa2
add esp, 8
test eax, eax
jne 0x43d0ab
test dword [ebp - 0x2e], 0x4000
jne 0x43d0be
lea eax, [ebp - 0x138]
push eax
push edi
push str.Cant_create_dir__s:_non_dir__s_in_the_way
call fcn.00442857
add esp, 0xc
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x138]
push eax
call fcn.00443b8f
add esp, 4
test eax, eax
jne 0x43d113
lea eax, [esi + 1]
mov byte [esi], 0x5c
push 0x5c
push eax
call fcn.0043f2d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x43d050
push edi
mov ecx, ebx
call fcn.0043cee0
test al, al
jne 0x43cf6c
push edi
call fcn.00443b8f
add esp, 4
test eax, eax
je 0x43cf6c
push edi
push str.Unable_to_create_dir__s
call fcn.00442857
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x138]
push eax
push str.Cant_create_dir__s:_mkdir_fails
call fcn.00442857
add esp, 8
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x450754
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x493560]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00448730
mov dword [ebp - 0x14], eax
cmp dword [0x4abd48], esi
jne 0x450847
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4507d4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x450927
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x450927
push 0x47a048
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x450927
push eax
call ebx
push 0x47a054
push edi
mov dword [0x4abd48], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4abd4c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4abd50], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4abd58], eax
test eax, eax
je 0x450844
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4abd54], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x45086c
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x45085f
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x450881
push 4
pop eax
jmp 0x450929
cmp dword [ebp - 0x14], esi
je 0x450881
push dword [0x4abd48]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x450866
mov eax, dword [0x4abd54]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4508df
cmp dword [0x4abd58], edi
je 0x4508df
push eax
call ebx
push dword [0x4abd58]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4508df
test eax, eax
je 0x4508df
call ecx
test eax, eax
je 0x4508d4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4508d4
test byte [ebp - 8], 1
jne 0x4508df
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x45090f
mov eax, dword [0x4abd4c]
cmp eax, edi
je 0x45090c
push eax
call ebx
test eax, eax
je 0x45090c
call eax
mov esi, eax
test esi, esi
je 0x45090c
mov eax, dword [0x4abd50]
cmp eax, edi
je 0x45090c
push eax
call ebx
test eax, eax
je 0x45090c
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4abd48]
call ebx
test eax, eax
je 0x450927
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x450929
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00443cd4
mov esp, ebp
pop ebp
ret
Function at 0x45fa7e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219

Function at 0x40110b
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x401158
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x404]
push 0x3ff
push 0x400
push eax
call fcn.004011a6
lea eax, [ebp - 0x404]
push eax
call fcn.004011a6
add esp, 0x18
push 1
call dword [sym.imp.kernel32.dll_ExitProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401b66
leave
ret

Function at 0x4011a6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x4011b5
pop dword [ebp - 0x40]
mov eax, 0x4011b5
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x278d9bdd
add dword [ebp - 0x50], 0x26c4a96e
mov dword [ebp - 0x4c], 0xa97f724e
add dword [ebp - 0x4c], 0x88b3d9f7
mov dword [ebp - 0x48], 0x56501c3c
sub dword [ebp - 0x48], 0xa03d80e
mov dword [ebp - 0x44], 0x605d9916
add dword [ebp - 0x44], 0x9fa266ea
lea eax, [ebp - 0x50]
push eax
mov eax, 0x7618f8e0
add eax, 0x8a27d76c
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x15feb703
sub dword [ebp - 0x50], 0xa18c4dad
mov dword [ebp - 0x4c], 0xa34bb49e
add dword [ebp - 0x4c], 0x9e20acd7
mov dword [ebp - 0x48], 0x3f413cfe
add dword [ebp - 0x48], 0x242e2f6e
mov dword [ebp - 0x44], 0xff83f8f8
sub dword [ebp - 0x44], 0xff83f8f8
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xe1b722b1
sub eax, 0xe1765269
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3acef
push 0
call eax
mov ecx, 0x4d57
mov edx, eax
mov ebx, 0x8525d214
sub ebx, 0x84e42214
add ebx, dword [ebp - 0x40]
mov edi, 0x66acaa06
add dword [ebp - 0xc], ecx
mov esi, dword [ebx]
sub dword [ebp - 0x14], 0x28c4a80a
add esi, edi
sub dword [ebp - 4], edx
mov dword [edx], esi
xor dword [ebp - 0x2c], 0x43dd3859
add edx, 4
add ebx, 0x61d2550b
add ebx, 0x9e2daaf9
loop 0x4012c6
add eax, 0xefbe3a7c
sub eax, 0xefbd124d
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d

Function at 0x408ce0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x408cef
pop dword [ebp - 0x48]
mov eax, 0xa4836026
add eax, 0x5bbd2cc9
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xbee152ea
sub dword [ebp - 0x58], 0x708f0d9f
mov dword [ebp - 0x54], 0xd7188c76
add dword [ebp - 0x54], 0x5b1abfcf
mov dword [ebp - 0x50], 0x757a50e2
add dword [ebp - 0x50], 0xd6d1f34c
mov dword [ebp - 0x4c], 0x2288a4d
add dword [ebp - 0x4c], 0xfdd775b3
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x541e88a6
add dword [ebp - 0x58], 0x2053e0b0
mov dword [ebp - 0x54], 0xe9e42e4e
add dword [ebp - 0x54], 0x57883327
mov dword [ebp - 0x50], 0x60145273
add dword [ebp - 0x50], 0x35b19f9
mov dword [ebp - 0x4c], 0x5daf3e8d
sub dword [ebp - 0x4c], 0x5daf3e8d
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x1fa1ebec
sub eax, 0x1f611ba4
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3a39e
push 0
call eax
mov ecx, 0x4b06
xor esi, esi
add esi, eax
mov edi, 0x41b000
add edi, dword [ebp - 0x48]
mov ebx, 0x5686461f
sub dword [ebp - 0x1c], 0xc120131f
mov edx, dword [edi]
xor dword [ebp - 0xc], 0x60e1c2cd
xor edx, ebx
mov dword [esi], edx
xor dword [ebp - 0x28], edi
add esi, 0x277e065b
add esi, 0xd881f9a9
add edi, 0x12a3200c
sub edi, 0x12a32008
loop 0x408dfc
add eax, 0x11eeb
xor ebx, ebx
add ebx, eax
add eax, 0x81c7704
sub eax, 0x81c76ff
mov ecx, 0x15da19ae
add ecx, 0xea65e652
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401970
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4064b0
push 0x4057f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edx, edx
mov dl, ah
mov dword [0x40a698], edx
mov ecx, eax
and ecx, 0xff
mov dword [0x40a694], ecx
shl ecx, 8
add ecx, edx
mov dword [0x40a690], ecx
shr eax, 0x10
mov dword [0x40a68c], eax
call fcn.004040a0
test eax, eax
jne 0x4019da
push 0x1c
call fcn.004020a0
add esp, 4
mov dword [ebp - 4], 0
call fcn.00402340
call fcn.00404df0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40aa50], eax
call fcn.00401f40
mov dword [0x40a674], eax
test eax, eax
je 0x401a0d
mov eax, dword [0x40aa50]
test eax, eax
jne 0x401a17
push 0xffffffffffffffff
call fcn.00401b10
add esp, 4
call fcn.004018d0
call fcn.004050f0
call fcn.004050b0
mov esi, dword [0x40aa50]
mov dword [ebp - 0x64], esi
cmp byte [esi], 0x22
jne 0x401af6
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
cmp al, 0x22
je 0x401a5e
test al, al
je 0x401a5e
and eax, 0xff
push eax
call fcn.004040e0
add esp, 4
test eax, eax
je 0x401a38
inc esi
mov dword [ebp - 0x64], esi
jmp 0x401a38
cmp byte [esi], 0x22
jne 0x401a67
inc esi
mov dword [ebp - 0x64], esi
mov al, byte [esi]
test al, al
je 0x401a77
cmp al, 0x20
ja 0x401a77
inc esi
mov dword [ebp - 0x64], esi
jmp 0x401a67
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x401a98
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x401a9d
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x60], eax
push eax
call fcn.00401b10
jmp 0x401adb
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x401a67
inc esi
mov dword [ebp - 0x64], esi
jmp 0x401af6
Function at 0x401f40
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x40a7d8]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x401f82
call edi
mov esi, eax
test esi, esi
je 0x401f6c
mov eax, 1
jmp 0x401f7d
call ebp
mov ebx, eax
test ebx, ebx
je 0x40208f
mov eax, 2
mov dword [0x40a7d8], eax
cmp eax, 1
jne 0x402022
test esi, esi
jne 0x401f9b
call edi
mov esi, eax
test esi, esi
je 0x40208f
cmp word [esi], 0
mov eax, esi
je 0x401fb5
add eax, 2
cmp word [eax], 0
jne 0x401fa3
add eax, 2
cmp word [eax], 0
jne 0x401fa3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x402014
push edi
call fcn.00403ae0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x402014
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x402006
push ebx
call fcn.00403b00
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x40208f
test ebx, ebx
jne 0x402033
call ebp
mov ebx, eax
test ebx, ebx
je 0x40208f
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x40204b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40203b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40203b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.00403ae0
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x40206d
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x402160
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x4075c0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x402184
add eax, 8
inc ebp
cmp eax, 0x407650
jb 0x402175
cmp ecx, dword [ebp*8 + 0x4075c0]
jne 0x40232b
mov eax, dword [0x40a67c]
cmp eax, 1
je 0x4022ed
test eax, eax
jne 0x4021b0
cmp dword [0x40741c], 1
je 0x4022ed
cmp ecx, 0xfc
je 0x40232b
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4021eb
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x402234
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x406790
add ebx, ecx
push ebx
call fcn.004058d0
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x406770
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x4075c4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00403de0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x40a940]
test eax, eax
je 0x4022fe
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x402308
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x4075c4]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x404100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, dword [0x407199]
push 0x10000
mov edx, dword [ebp + 8]
pop esi
mov eax, dword [0x40713c]
and edx, eax
mov eax, dword [edx]
cmp ax, di
je 0x401bca
sub edx, esi
jmp 0x401bbf
mov dword [ebp - 8], edx
mov eax, edx
mov ecx, dword [eax + 0x3c]
add eax, 0x78
and ecx, 0xffff
add eax, ecx
mov eax, dword [eax]
mov esi, dword [ebp - 8]
push esi
add esi, eax
mov eax, dword [esi + 0x20]
pop edi
add edi, eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x14], eax
jmp 0x404474
mov esi, dword [ebp - 0xc]
inc esi
mov ecx, dword [esi + 0x23]
mov eax, dword [ebp - 4]
add eax, eax
add ecx, dword [ebp - 8]
add ecx, eax
movzx eax, word [ecx]
mov ecx, dword [esi + 0x1b]
lea eax, [ecx + eax*4]
dec esi
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + eax]
add eax, ecx
test eax, eax
jne 0x40441d
pop esi
and byte [eax + 0x68b105e], cl
cmp eax, ebx
je 0x401e6f
push eax
call 0x4688db
add esp, 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
pop esi
pop ebx
ret
push dword [ebp - 0x14]
pop ecx
mov eax, dword [edi]
mov esi, dword [ebp - 8]
add esi, eax
xor eax, eax
push ecx
mov ecx, eax
push esi
add edi, 4
lodsb al, byte [esi]
add ecx, 1
test eax, eax
jne 0x403c0f
dec ecx
pop esi
cmp ecx, dword [ebp - 0x10]
je 0x403c24
inc dword [ebp - 4]
pop ecx
loop 0x403bff
push esi
push dword [ebp + 0xc]
call fcn.00404700
test eax, eax
jne 0x403c1e
je 0x401e30
add dword [ebx + ecx - 0x73], esi
lea eax, [edi + edi*8 - 1]
invalid
salc
invalid
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, 8
push esi
push edi
test eax, eax
jne 0x401ba9
call fcn.00404700
call 0x40b551a2
les esi, [eax + ebp*8 + 0x24]
call 0x2504cc38
add byte [ebp + 0x1048301], cl
je 0x4040bb
mov eax, dword [esp + eax*8]
les ecx, [ecx + 0x4e88910]
test dword [ecx], eax
nop
add dword [esp + ecx*8], eax
add al, 0xcc
and al, 0
inc eax
test dword [eax], ecx
and al, 0x83
add al, 0x8b
inc eax
ror ah, 0x90
inc eax
je 0x404151
dec dword [ecx - 0x74177401]
add al, 0x74
mov edi, edi
mov ebp, eax
mov eax, dword [esp + esi*2]
sal byte [eax + edx*2 - 1], 0x8b
add dword [ebp - 0x8bdbfc], 0x24
add byte [eax], dl
les edx, [eax - 0x747a7c8b]
inc dword [ebp - 0x727c74b0]
adc byte [ebx + 0x1074248d], al
or ah, cl
invalid
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0xc], esi
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, eax
mov esi, dword [ebp + 0xc]
lodsb al, byte [esi]
inc ecx
test eax, eax
jne 0x404481
dec ecx
mov dword [ebp - 0x10], ecx
test ecx, ecx
jne 0x403bfb
daa
push 4
push 1
push eax
call 0x448f1d
mov eax, dword [esi + 0x14]
push 3
push 1
push eax
call 0x448f1d
mov ecx, dword [esi + 0x14]
push 2
push 1
push ecx
call 0x448f1d
add esp, 0x24
mov eax, esi
pop esi
pop ebx
ret