joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fb50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44efb9
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4655f0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push edi
mov eax, dword [0x4655f0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor ebp, ebp
mov dword [esp + 0x38], ebp
mov edi, ecx
mov dword [esp + 0x1c], ebp
mov eax, dword [edi]
sub eax, 0x10
cmp dword [eax + 0xc], 1
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], edi
jle 0x40fba9
mov eax, dword [eax + 4]
push eax
call fcn.004016e0
mov eax, dword [edi]
call fcn.0040fa40
mov ebx, eax
push ebx
push 0x457618
push edi
call fcn.00401d60
push ebx
call fcn.004181cf
add esp, 0x10
call fcn.00418933
xor ecx, ecx
cmp eax, ebp
setne cl
cmp ecx, ebp
jne 0x40fbe1
push 0x80004005
call fcn.00401640
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x38], ebp
mov ecx, dword [edi]
mov eax, dword [ecx - 0xc]
test eax, eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebp
jg 0x40fc34
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00437030
add esp, 0x2c
ret
mov edi, dword [esp + 0x14]
test ebp, ebp
jl 0x40fd42
mov eax, dword [edi]
cmp ebp, dword [eax - 0xc]
jg 0x40fd42
mov bl, byte [eax + ebp]
movzx edi, bl
push edi
call fcn.00438b21
add esp, 4
test eax, eax
je 0x40fca5
mov eax, dword [esi]
mov ebp, dword [eax - 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
lea edi, [ebp + 1]
sub eax, edi
or eax, ecx
jge 0x40fc7b
push edi
mov ecx, esi
call fcn.00401690
test edi, edi
mov eax, dword [esi]
mov byte [eax + ebp], bl
jl 0x40fd42
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x40fd42
mov ebp, dword [esp + 0x10]
mov dword [eax - 0xc], edi
mov edx, dword [esi]
mov byte [edi + edx], 0
jmp 0x40fd2c
cmp bl, 0x20
jne 0x40fceb
mov eax, dword [esi]
mov ebp, dword [eax - 0xc]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
lea edi, [ebp + 1]
sub eax, edi
or eax, ecx
jge 0x40fccb
push edi
mov ecx, esi
call fcn.00401690
test edi, edi
mov eax, dword [esi]
mov byte [eax + ebp], 0x2b
jl 0x40fd42
mov eax, dword [esi]
cmp edi, dword [eax - 8]
jg 0x40fd42
mov ebp, dword [esp + 0x10]
mov dword [eax - 0xc], edi
mov eax, dword [esi]
mov byte [edi + eax], 0
jmp 0x40fd2c
push edi
xor eax, eax
lea ecx, [esp + 0x28]
push str.___02X
push ecx
mov byte [esp + 0x30], 0
mov dword [esp + 0x31], eax
mov byte [esp + 0x35], al
call fcn.00437349
lea eax, [esp + 0x30]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x40fd14
sub eax, edx
push eax
lea edx, [esp + 0x28]
push edx
mov ecx, esi
call fcn.00402190
add ebp, 1
cmp ebp, dword [esp + 0x18]
mov dword [esp + 0x10], ebp
jl 0x40fc30
jmp 0x40fc0c
push 0x80070057
call fcn.00401640
int3
Function at 0x416640
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x14
push esi
push edi
push 0x456f6e
push str.Shell_TrayWnd
xor esi, esi
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x416672
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [esp + 0x14]
sub esi, dword [esp + 0xc]
sub esi, 2
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov dword [ebx + 0xbc], eax
call edi
sub eax, esi
pop edi
mov dword [ebx + 0xc0], eax
pop esi
add esp, 0x14
ret
Function at 0x417fa0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x44e4a6
mov eax, dword fs:[0]
push eax
sub esp, 0x320
mov eax, dword [0x4655f0]
xor eax, esp
mov dword [esp + 0x31c], eax
push ebx
push ebp
push esi
mov eax, dword [0x4655f0]
xor eax, esp
push eax
lea eax, [esp + 0x330]
mov dword fs:[0], eax
mov eax, dword [esp + 0x340]
mov ebp, dword [esp + 0x344]
xor ebx, ebx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x24]
push ecx
push 0x104
push eax
mov dword [esp + 0x348], ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp eax, ebx
jne 0x418038
mov dword [esp + 0x338], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x41802e
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, 0x80004005
jmp 0x418129
lea ecx, [esp + 0x10]
push ecx
push 0x456658
push 1
push ebx
push 0x456668
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x41810c
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [esp + 0x14], ebx
je 0x41807b
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0x14]
push ecx
push 0x459694
push eax
call edx
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
mov byte [esp + 0x338], 1
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov esi, eax
cmp esi, ebx
jl 0x4180f5
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov esi, eax
cmp esi, ebx
jl 0x4180f5
cmp ebp, ebx
je 0x4180c1
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push ebx
push ebp
push eax
call edx
mov esi, eax
cmp esi, ebx
jl 0x4180f5
mov ecx, dword [esp + 0x18]
push 0x104
lea eax, [esp + 0x128]
push eax
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 1
lea ecx, [esp + 0x128]
push ecx
push eax
call edx
mov esi, eax
mov byte [esp + 0x338], bl
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x41810c
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x338], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x418127
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0x330]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x31c]
xor ecx, esp
call fcn.00437030
add esp, 0x32c
ret

Function at 0x41c8fc
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x41c935
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00418236
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00403df0
pop esi
ret 4
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
pop esi
jmp dword [eax + 0x8c]
Function at 0x41e4be
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x41e501
call fcn.0041fb5f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41e501
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41e51c
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041e075
test ebx, ebx
mov esi, eax
je 0x41e51a
test edi, edi
je 0x41e51a
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x423475
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x24
mov eax, 0x44d446
call fcn.00439946
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [esi + 0x60]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x5c]
mov dword [ebp - 0x18], eax
call fcn.0041fb5f
mov edi, dword [eax + 0xc]
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x4234c0
call fcn.0041fb5f
mov edi, dword [eax + 0xc]
push 5
push dword [esi + 0x58]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x4234d1
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x4234de
or eax, 0xffffffff
jmp 0x42363a
mov ecx, esi
call fcn.00422fbc
mov dword [ebp - 0x14], eax
call fcn.0041b97c
and dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], ebx
je 0x42355c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x14], eax
je 0x42355c
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x42355c
push 0
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x2c], 1
call fcn.0041a4ff
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0x24], ebx
je 0x42355c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x120]
test eax, eax
je 0x42355c
mov ecx, ebx
call fcn.0041fdfd
test eax, eax
je 0x42355c
push 0
mov ecx, ebx
call fcn.0041fe18
mov dword [ebp - 0x28], 1
and dword [ebp - 4], 0
push esi
call fcn.0041d331
push dword [ebp - 0x14]
call fcn.0041b8d4
push edi
push eax
push dword [ebp - 0x1c]
mov ecx, esi
call fcn.0042327d
xor edi, edi
cmp eax, edi
je 0x4235b9
test byte [esi + 0x3c], 0x10
je 0x4235a3
push 4
pop edi
mov ecx, esi
call fcn.0041fcba
test ax, 0x100
je 0x423599
push 5
pop edi
push edi
mov ecx, esi
call fcn.0041b46a
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x4235b9
push 0x97
push edi
push edi
push edi
push edi
push edi
mov ecx, esi
call fcn.0041ffeb
or dword [ebp - 4], 0xffffffff
jmp 0x4235e4
cmp dword [ebp - 0x28], edi
je 0x4235f2
push 1
mov ecx, ebx
call fcn.0041fe18
cmp dword [ebp - 0x2c], edi
je 0x423602
push 1
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [ebp - 0x14], edi
je 0x42361b
call dword [sym.imp.USER32.dll_GetActiveWindow]
cmp eax, dword [esi + 0x20]
jne 0x42361b
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x60]
mov ecx, esi
call fcn.00422ff6
cmp dword [esi + 0x58], edi
je 0x423637
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [esi + 0x44]
call fcn.004399eb
ret
Function at 0x423ba1
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0xe0]
sub esp, 0x160
mov eax, dword [0x4655f0]
xor eax, ebp
mov dword [ebp + 0xdc], eax
cmp dword [ebp + 0xec], 0x800
mov eax, dword [ebp + 0xe8]
push esi
mov dword [ebp - 0x3c], eax
mov esi, ecx
lea eax, [ebp - 0x40]
jne 0x423c39
push 0x45327c
push 4
push eax
call fcn.00437c78
push eax
call fcn.00403d50
add esp, 0x10
push ebx
push edi
call fcn.00439cc7
mov edi, dword [eax]
call fcn.00439cc7
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.004373e0
add esp, 0x18
mov dword [ebp - 0x3c], eax
call fcn.00439cc7
cmp dword [eax], ebx
je 0x423c50
call fcn.00439cc7
push dword [eax]
call fcn.0041841d
pop ecx
jmp 0x423c57
push 4
push eax
push 3
push dword [ebp + 0xec]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x423bed
jmp 0x423cc9
call fcn.00439cc7
mov dword [eax], edi
cmp dword [ebp - 0x3c], 0xffffffff
je 0x423cc5
cmp dword [ebp - 0x3c], esi
jae 0x423cc5
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x7c]
push ebx
push eax
mov dword [ebp - 0x80], 0x40
call fcn.0043b390
add esp, 0xc
push str.KERNEL32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x423cb7
push str.FindActCtxSectionStringA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x423cb7
lea ecx, [ebp - 0x80]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x423cb7
push ebx
push ebx
push esi
jmp 0x423cbd
push ebx
push ebx
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
jmp 0x423cc7
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp + 0xdc]
xor ecx, ebp
pop esi
call fcn.00437030
add ebp, 0xe0
leave
ret
Function at 0x425330
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x425376
call fcn.0041fb5f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x425376
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x4253b9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x4253a2
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4253a2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4253b6
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4278e5
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x42790e
call fcn.0041fb5f
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x427931
push eax
push dword [esi + 4]
call fcn.00427870
push esi
push eax
mov ecx, 0x46895c
call fcn.00427526
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x4282e0
Capabilities:
Connect to http server

Disassembly:
push 4
mov eax, 0x44d84c
call fcn.00439913
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x1c]
mov edi, dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.004282a2
and dword [ebp - 4], 0
lea ecx, [esi + 0x18]
mov dword [esi], vtable.CHttpConnection.0
call fcn.00401d80
push dword [esi + 8]
mov edi, dword [edi + 8]
push 0
push 3
push dword [ebp + 0x18]
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.WININET.dll_InternetConnectA]
test eax, eax
mov dword [esi + 4], eax
jne 0x428346
push eax
push dword [esi + 8]
call fcn.00427870
push dword [esi + 0xc]
mov ecx, 0x46895c
push eax
call fcn.00427526
mov eax, esi
call fcn.004399eb
ret 0x18
Function at 0x429c47
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
jne 0x429c50
xor eax, eax
jmp 0x429cb9
cmp dword [esp + 8], 0
jne 0x429c5c
call fcn.0041882b
push edi
push dword [esi + 0x10]
push dword [esp + 0x14]
push 1
push dword [esp + 0x18]
call fcn.0043cfe8
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x429c97
push dword [esi + 0x10]
call fcn.0043ccee
test eax, eax
pop ecx
jne 0x429c97
mov esi, dword [esi + 0xc]
call fcn.00439cda
push esi
push dword [eax]
push 1
call fcn.00428df5
push dword [esi + 0x10]
call fcn.0043cd1d
test eax, eax
pop ecx
je 0x429cb6
push dword [esi + 0x10]
call fcn.0043cc42
push eax
call fcn.00403d50
pop ecx
pop ecx
jmp 0x429c85
mov eax, edi
pop edi
pop esi
ret 8

Function at 0x429cc2
Capabilities:
Write file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
mov esi, ecx
jne 0x429ccc
call fcn.0041882b
push dword [esi + 0x10]
push dword [esp + 0x10]
push 1
push dword [esp + 0x14]
call fcn.0043d162
add esp, 0x10
cmp eax, dword [esp + 0xc]
je 0x429cf9
mov esi, dword [esi + 0xc]
call fcn.00439cda
push esi
push dword [eax]
push 1
call fcn.00428df5
pop esi
ret 8

Function at 0x437030
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4655f0]
jne 0x43703a
repz ret
jmp fcn.0044177b
Function at 0x43cd4c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x43cd89
cmp dword [ebp + 0x14], edi
je 0x43cd89
cmp ecx, edi
jne 0x43cd90
call fcn.00439cc7
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00438c52
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x43cda4
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x43cdc5
cmp ebx, 0xffffffff
je 0x43cdb4
push ebx
push edi
push ecx
call fcn.0043b390
add esp, 0xc
cmp esi, edi
je 0x43cd71
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x43cd71
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x43cde1
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x43cde8
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x43ced9
test word [esi + 0xc], 0x10c
je 0x43ce3c
mov eax, dword [esi + 4]
test eax, eax
je 0x43ce3c
jl 0x43cf3a
cmp ebx, eax
mov edi, ebx
jb 0x43ce0d
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x43cee1
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.004367da
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x43ced1
cmp ebx, dword [ebp - 0xc]
jb 0x43cea9
cmp dword [ebp - 0xc], 0
je 0x43ce66
mov ecx, SysReAllocString
xor edx, edx
cmp ebx, ecx
jbe 0x43ce5b
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x43ce62
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x43ce71
mov eax, SysReAllocString
cmp ebx, eax
ja 0x43ce71
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x43cf0d
push eax
push dword [ebp - 8]
push esi
call fcn.0043c9a1
pop ecx
push eax
call fcn.00447818
add esp, 0xc
test eax, eax
je 0x43cf4c
cmp eax, 0xffffffff
je 0x43cf3a
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x43ced1
push esi
call fcn.00447137
cmp eax, 0xffffffff
pop ecx
je 0x43cf3e
cmp dword [ebp - 4], 0
je 0x43cf0d
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x43cdf0
mov eax, dword [ebp + 0x14]
jmp 0x43cd8b
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x43cef8
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0043b390
add esp, 0xc
call fcn.00439cc7
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x43cd81
cmp dword [ebp + 0xc], 0xffffffff
je 0x43cf23
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0043b390
add esp, 0xc
call fcn.00439cc7
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x43cd81
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x43cd8b
or dword [esi + 0xc], 0x10
jmp 0x43cf3e
Function at 0x43ffa3
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x465ed8]
je 0x43ffbe
inc edi
cmp edi, 0x17
jb 0x43ffaf
cmp edi, 0x17
jae 0x44013e
push ebp
push 3
call fcn.004487e2
cmp eax, 1
pop ecx
je 0x44010a
push 3
call fcn.004487e2
test eax, eax
pop ecx
jne 0x43fff2
cmp dword [0x4655e4], 1
je 0x44010a
cmp ebx, 0xfc
je 0x44013d
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x468eb0
push ebp
call fcn.00437c78
add esp, 0xc
test eax, eax
je 0x440028
push esi
push esi
push esi
push esi
push esi
call fcn.00438b56
add esp, 0x14
push 0x104
mov esi, 0x468ec9
push esi
push 0
mov byte [0x468fcd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x44006c
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00437c78
add esp, 0xc
test eax, eax
je 0x44006c
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00438b56
add esp, 0x14
push esi
call fcn.00439490
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4400b1
push esi
call fcn.00439490
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4691c4
push 0x4554d4
sub ecx, eax
push ecx
push eax
call fcn.0043b40a
add esp, 0x14
test eax, eax
je 0x4400b1
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00438b56
add esp, 0x14
jmp 0x4400b3
xor esi, esi
push 0x4554d0
push ebx
push ebp
call fcn.0043bd72
add esp, 0xc
test eax, eax
je 0x4400d3
push esi
push esi
push esi
push esi
push esi
call fcn.00438b56
add esp, 0x14
push dword [edi*8 + 0x465edc]
push ebx
push ebp
call fcn.0043bd72
add esp, 0xc
test eax, eax
je 0x4400f5
push esi
push esi
push esi
push esi
push esi
call fcn.00438b56
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00448625
add esp, 0xc
jmp 0x44013d
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x44013d
cmp ebp, 0xffffffff
je 0x44013d
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x465edc]
push dword [esi]
call fcn.00439490
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x448625
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0043ec32
xor ebx, ebx
cmp dword [0x469710], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x4486fb
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x4487db
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x455f18
push edi
call esi
cmp eax, ebx
je 0x4487db
push eax
call fcn.0043ebc4
mov dword [esp], 0x455f08
push edi
mov dword [0x469710], eax
call esi
push eax
call fcn.0043ebc4
mov dword [esp], 0x455ef4
push edi
mov dword [0x469714], eax
call esi
push eax
call fcn.0043ebc4
mov dword [0x469718], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00437d86
test eax, eax
pop ecx
pop ecx
je 0x4486c9
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00438b56
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x4486fb
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0043ebc4
cmp eax, ebx
pop ecx
mov dword [0x469720], eax
je 0x4486fb
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043ebc4
pop ecx
mov dword [0x46971c], eax
mov eax, dword [0x46971c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x448780
cmp dword [0x469720], ecx
je 0x448780
push eax
call fcn.0043ec3b
push dword [0x469720]
mov esi, eax
call fcn.0043ec3b
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x448780
cmp edi, ebx
je 0x448780
call esi
cmp eax, ebx
je 0x44874d
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44874d
test byte [ebp - 0x18], 1
jne 0x448780
lea eax, [ebp - 0x10]
push eax
call fcn.00437dbd
test eax, eax
pop ecx
je 0x448768
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00438b56
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x448777
or dword [ebp + 0x10], 0x200000
jmp 0x4487bb
or dword [ebp + 0x10], 0x40000
jmp 0x4487bb
mov eax, dword [0x469714]
cmp eax, dword [ebp - 8]
je 0x4487bb
push eax
call fcn.0043ec3b
cmp eax, ebx
pop ecx
je 0x4487bb
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4487bb
mov eax, dword [0x469718]
cmp eax, dword [ebp - 8]
je 0x4487bb
push eax
call fcn.0043ec3b
cmp eax, ebx
pop ecx
je 0x4487bb
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x469710]
call fcn.0043ec3b
cmp eax, ebx
pop ecx
je 0x4487db
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4487dd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret