joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a760
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x4504c0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x466a78]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
push edi
lea ecx, [esp + 0x1c]
call fcn.004048e0
mov ebp, dword [esp + 0x34]
push ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0
call fcn.004048e0
mov byte [esp + 0x28], 1
call fcn.00425212
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40a7c9
push 0x80004005
call fcn.004010d0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x10]
push 0x5c
push ecx
mov byte [esp + 0x30], 2
call fcn.0043b24c
add esp, 8
test eax, eax
jne 0x40a7f6
or eax, 0xffffffff
jmp 0x40a7fa
sub eax, dword [esp + 0x10]
push eax
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
call fcn.004024b0
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x2c], 3
call fcn.004028c0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x28], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a83d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x14]
push esi
call fcn.0040a1f0
add esp, 4
push 0
push ebp
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
or edx, 0xffffffff
test eax, eax
lea eax, [esi - 0x10]
mov byte [esp + 0x28], 1
lea ecx, [eax + 0xc]
jne 0x40a8db
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a879
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a89e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a8c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a8ee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x28], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a913
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a93b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret
Function at 0x40aa00
Capabilities:
Read .ini file

Disassembly:
cmp dword [ecx + 0x1c], 0x10
jb 0x40aa0b
mov ecx, dword [ecx + 8]
jmp 0x40aa0e
add ecx, 8
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x40aa1d
mov edx, dword [eax + 4]
jmp 0x40aa20
lea edx, [eax + 4]
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x40aa3b
mov eax, dword [eax + 4]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret 8
push ecx
push 0
add eax, 4
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret 8

Function at 0x40b050
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x208
mov eax, dword [0x466a78]
xor eax, esp
mov dword [esp + 0x204], eax
push ebx
mov ebx, dword [esp + 0x214]
push ebp
mov ebp, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x218]
push edi
push 0x1ff
lea eax, [esp + 0x19]
push 0
push eax
mov edi, ecx
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
call fcn.0043b9e0
mov eax, 0x10
add esp, 0xc
cmp dword [edi + 0x1c], eax
jb 0x40b0af
mov edi, dword [edi + 8]
jmp 0x40b0b2
add edi, 8
cmp dword [ebp + 0x18], eax
jb 0x40b0bc
mov ebp, dword [ebp + 4]
jmp 0x40b0bf
add ebp, 4
cmp dword [ebx + 0x18], eax
jb 0x40b0c9
mov eax, dword [ebx + 4]
jmp 0x40b0cc
lea eax, [ebx + 4]
push edi
push 0x200
lea ecx, [esp + 0x1c]
push ecx
push 0x45373e
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40b128
lea eax, [esp + 0x14]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40b0f0
sub eax, edx
je 0x40b128
lea eax, [esp + 0x14]
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], cl
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40b115
sub eax, edx
push eax
lea edx, [esp + 0x18]
push edx
jmp 0x40b141
push 0
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], 0
mov byte [esi + 4], 0
push 0x45373e
mov ecx, esi
call fcn.00402700
mov ecx, dword [esp + 0x214]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043b96b
add esp, 0x208
ret 0xc

Function at 0x40b380
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
mov eax, dword [0x466a78]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x110]
cmp dword [eax], 0
push ebx
mov ebx, dword [esp + 0x110]
push esi
mov esi, ecx
je 0x40b410
push edi
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov edi, eax
lea eax, [esp + 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40b3c5
sub eax, edx
push eax
lea edx, [esp + 0x10]
add esi, 4
push edx
mov ecx, esi
call fcn.00402700
cmp byte [esp + edi + 0xb], 0x5c
pop edi
mov ecx, esi
jne 0x40b3f6
push 0xffffffffffffffff
push 0
push ebx
call fcn.0040ac50
jmp 0x40b41d
push 1
push 0x454300
call fcn.0040ad50
push 0xffffffffffffffff
push 0
push ebx
mov ecx, esi
call fcn.0040ac50
jmp 0x40b41d
push 0xffffffffffffffff
push 0
push ebx
lea ecx, [esi + 4]
call fcn.00402620
mov ecx, dword [esp + 0x10c]
pop esi
pop ebx
xor ecx, esp
call fcn.0043b96b
add esp, 0x108
ret 8
Function at 0x40d880
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x450968
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x466a78]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
mov ecx, dword [esp + 0x28]
push edi
mov dword [esp + 0x1c], 0
call fcn.004028c0
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x2c]
push eax
push ecx
add esi, 0xfffffff0
mov dword [esp + 0x28], esp
mov ebx, esp
push esi
call fcn.00401a50
mov ecx, dword [esp + 0x30]
sub ecx, edi
add esp, 4
sar ecx, 2
push ecx
add eax, 0x10
push 0
push edi
mov dword [ebx], eax
call fcn.0040d790
add esp, 0x14
mov dword [esp + 0x18], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40d910
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x418009
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [ebp + 0x10]
jle 0x418046
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x418023
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x418062
dec esi
je 0x41805b
dec esi
jne 0x418067
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x419465
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebx + 0x1c], eax
mov eax, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebx + 4], eax
xor eax, eax
cmp byte [ebp + 0x24], al
mov dword [ebx + 0x10], ecx
mov ecx, dword [ebp + 0x10]
push edi
mov word [ebx + 0xc], ax
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x24], ecx
mov dword [ebx + 0x28], eax
jne 0x4194af
mov ecx, 0x2000
lea edi, [esi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov word [ebx + 0x2c], ax
mov dword [ebx + 0x30], eax
call fcn.00418ec1
mov eax, dword [ebx + 0x14]
and dword [ebx + 0x20], 0
mov ecx, 0x8000
push 2
mov word [ebx + 0x3c], cx
mov dword [ebx + 0x34], ecx
add eax, ecx
pop edx
movzx edi, byte [eax]
mov esi, dword [ebx + 0x20]
shl esi, 5
xor esi, edi
and esi, 0x7fff
inc eax
dec edx
mov dword [ebx + 0x20], esi
jne 0x4194d3
cmp byte [ebp + 0x24], 0
je 0x4194fa
mov edi, ebx
call fcn.00418d1f
jmp 0x419509
xor eax, eax
mov edx, dword [ebx + 0x18]
and word [eax + edx], 0
inc eax
inc eax
dec ecx
jne 0x4194fc
push 8
pop edi
push 0x43
pop edx
mov eax, ebx
call fcn.00418178
push 0x4b
pop edx
call fcn.00418178
call fcn.004191e9
mov ecx, dword [ebp + 0x28]
inc eax
inc eax
cmp byte [ebp + 0x24], 0
movzx eax, ax
mov dword [ecx], eax
je 0x419543
mov edi, dword [ebx + 0x14]
mov ecx, 0x2000
lea esi, [edi + 0x8000]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 0x28]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 3
pop ebx
pop ebp
ret 0x24
Function at 0x41cf94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x45144a
call fcn.0043d988
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.00423574
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x41cfdf
call fcn.00423574
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x41cff0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x41cffd
or eax, 0xffffffff
jmp 0x41d159
mov ecx, esi
call fcn.0041cadb
mov dword [ebp - 0x14], eax
call fcn.00420144
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x41d07b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x41d07b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x41d07b
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0041c96a
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x41d07b
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x41d07b
mov ecx, ebx
call fcn.00424096
test eax, eax
je 0x41d07b
push 0
mov ecx, ebx
call fcn.004240b1
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.00421b2c
push dword [ebp - 0x14]
call fcn.0042009c
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0041cd9c
xor edi, edi
cmp eax, edi
je 0x41d0d8
test byte [esi + 0x3c], 0x10
je 0x41d0c2
push 4
pop edi
mov ecx, esi
call fcn.00423f7d
test ax, 0x100
je 0x41d0b8
push 5
pop edi
push edi
mov ecx, esi
call fcn.0041fc64
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x41d0d8
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.00424280
or dword [ebp - 4], 0xffffffff
jmp 0x41d103
cmp dword [ebp - 0x28], edi
je 0x41d111
push 1
mov ecx, ebx
call fcn.004240b1
cmp dword [ebp - 0x2c], edi
je 0x41d121
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x41d13a
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x41d13a
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.0041cb15
cmp dword [esi + 0x58], edi
je 0x41d156
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.0043da2d
ret
Function at 0x4210fc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x421135
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004210bf
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004108a0
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]

Function at 0x422c5c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x422c9f
call fcn.00423574
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x422c9f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x422cba
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.00422813
test ebx, ebx
mov esi, eax
je 0x422cb8
test edi, edi
je 0x422cb8
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x427289
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x466a78]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0x800
push ebx
push esi
mov esi, ecx
mov ebx, edx
lea eax, [ebp - 0x11c]
jne 0x4272c9
push 0x457318
push 4
push eax
call fcn.0043b97a
push eax
call fcn.00401040
add esp, 0x10
jmp 0x4272db
push 4
push eax
push 3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
je 0x427349
push edi
call fcn.00439a11
mov edi, dword [eax]
call fcn.00439a11
and dword [eax], 0
lea eax, [ebp - 0x11c]
push eax
push ebx
push esi
push 0x111
mov esi, 0x112
lea eax, [ebp - 0x118]
push esi
push eax
call fcn.0043c41c
add esp, 0x18
mov ebx, eax
call fcn.00439a11
cmp dword [eax], 0
je 0x427329
call fcn.00439a11
push dword [eax]
call fcn.0041d636
pop ecx
jmp 0x427330
call fcn.00439a11
mov dword [eax], edi
cmp ebx, 0xffffffff
pop edi
je 0x427349
cmp ebx, esi
jae 0x427349
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x42734b
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b96b
leave
ret
Function at 0x428c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x428cd6
call fcn.00423574
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x428cd6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x428d19
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x428d02
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x428d02
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x428d16
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x42b588
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42b5b6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42b5d4
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042b4f2
jmp 0x42b5d4
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42b5d4
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0042b4f2
test edi, edi
mov eax, edi
jne 0x42b5be
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x469888]
test ecx, ecx
je 0x42b697
jmp 0x42b587
ret 8
Function at 0x43b96b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x466a78]
jne 0x43b975
repz ret
jmp fcn.0044692c

Function at 0x43bc94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x43bcc1
call fcn.00439a24
mov dword [eax], esi
call fcn.00439a11
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0043aed7
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x43bc9d
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x43bcf0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00439a37
pop ecx
call fcn.00439a11
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x43bd17
test al, 1
je 0x43bd17
test byte [esp + 0xc], 2
je 0x43bd17
call fcn.00439a24
mov dword [eax], 5
call fcn.00439a11
mov dword [eax], 0xd
jmp 0x43bce7
xor eax, eax
pop esi
ret

Function at 0x442dcc
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x467208]
je 0x442de7
inc edi
cmp edi, 0x17
jb 0x442dd8
cmp edi, 0x17
jae 0x442f67
push ebp
push 3
call fcn.0044b026
cmp eax, 1
pop ecx
je 0x442f33
push 3
call fcn.0044b026
test eax, eax
pop ecx
jne 0x442e1b
cmp dword [0x466a90], 1
je 0x442f33
cmp ebx, 0xfc
je 0x442f66
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x469d78
push ebp
call fcn.0043b97a
add esp, 0xc
test eax, eax
je 0x442e51
push esi
push esi
push esi
push esi
push esi
call fcn.0043addb
add esp, 0x14
push 0x104
mov esi, 0x469d91
push esi
push 0
mov byte [0x469e95], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x442e95
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0043b97a
add esp, 0xc
test eax, eax
je 0x442e95
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0043addb
add esp, 0x14
push esi
call fcn.0043da90
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x442eda
push esi
call fcn.0043da90
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x46a08c
push 0x4593dc
sub ecx, eax
push ecx
push eax
call fcn.0043db73
add esp, 0x14
test eax, eax
je 0x442eda
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0043addb
add esp, 0x14
jmp 0x442edc
xor esi, esi
push 0x4593d8
push ebx
push ebp
call fcn.00440258
add esp, 0xc
test eax, eax
je 0x442efc
push esi
push esi
push esi
push esi
push esi
call fcn.0043addb
add esp, 0x14
push dword [edi*8 + 0x46720c]
push ebx
push ebp
call fcn.00440258
add esp, 0xc
test eax, eax
je 0x442f1e
push esi
push esi
push esi
push esi
push esi
call fcn.0043addb
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0044ae69
add esp, 0xc
jmp 0x442f66
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x442f66
cmp ebp, 0xffffffff
je 0x442f66
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x46720c]
push dword [esi]
call fcn.0043da90
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x44ae69
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00441775
xor ebx, ebx
cmp dword [0x46a5f8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x44af3f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x44b01f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45a65c
push edi
call esi
cmp eax, ebx
je 0x44b01f
push eax
call fcn.00441707
mov dword [esp], 0x45a64c
push edi
mov dword [0x46a5f8], eax
call esi
push eax
call fcn.00441707
mov dword [esp], 0x45a638
push edi
mov dword [0x46a5fc], eax
call esi
push eax
call fcn.00441707
mov dword [0x46a600], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0043ff5e
test eax, eax
pop ecx
pop ecx
je 0x44af0d
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043addb
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x44af3f
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00441707
cmp eax, ebx
pop ecx
mov dword [0x46a608], eax
je 0x44af3f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00441707
pop ecx
mov dword [0x46a604], eax
mov eax, dword [0x46a604]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x44afc4
cmp dword [0x46a608], ecx
je 0x44afc4
push eax
call fcn.0044177e
push dword [0x46a608]
mov esi, eax
call fcn.0044177e
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x44afc4
cmp edi, ebx
je 0x44afc4
call esi
cmp eax, ebx
je 0x44af91
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44af91
test byte [ebp - 0x18], 1
jne 0x44afc4
lea eax, [ebp - 0x10]
push eax
call fcn.0043ff95
test eax, eax
pop ecx
je 0x44afac
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0043addb
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x44afbb
or dword [ebp + 0x10], 0x200000
jmp 0x44afff
or dword [ebp + 0x10], 0x40000
jmp 0x44afff
mov eax, dword [0x46a5fc]
cmp eax, dword [ebp - 8]
je 0x44afff
push eax
call fcn.0044177e
cmp eax, ebx
pop ecx
je 0x44afff
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x44afff
mov eax, dword [0x46a600]
cmp eax, dword [ebp - 8]
je 0x44afff
push eax
call fcn.0044177e
cmp eax, ebx
pop ecx
je 0x44afff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46a5f8]
call fcn.0044177e
cmp eax, ebx
pop ecx
je 0x44b01f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x44b021
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x44f553
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x466a78]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0044f4e8
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0043b9e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x44f5a2
cmp dword [ebp - 0x1c], 5
jb 0x44f5ba
jmp 0x44f5b6
cmp dword [ebp - 0x10], 1
jne 0x44f5ba
cmp dword [ebp - 0x1c], 4
ja 0x44f5b6
jne 0x44f5ba
cmp dword [ebp - 0x18], 0
jbe 0x44f5ba
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x45af14
call fcn.0044f3d9
test eax, eax
jge 0x44f5db
mov byte [0x467cd8], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0043b96b
add ebp, 0x78
leave
ret