joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429280
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x22f63248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
push edi
xor esi, esi
xor edi, edi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov eax, dword [ecx + 0xc]
mov ebp, dword [eax]
cmp ebp, eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x10], ebp
je 0x42934f
mov eax, dword [esp + 0x38]
mov ebx, dword [ebp + 8]
push eax
push ebx
call dword [0x22f661c4]
add esp, 8
test al, al
je 0x42933b
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, ebx
call fcn.00434140
test edi, edi
je 0x429322
mov ecx, dword [esp + 0x24]
mov eax, esi
sub eax, edi
sub ecx, edi
sar eax, 2
sar ecx, 2
cmp eax, ecx
jae 0x429322
mov edx, dword [esp + 0x38]
push edx
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 1
push esi
call fcn.00428600
add esp, 0x14
add esi, 4
mov dword [esp + 0x20], esi
jmp 0x42933b
lea edx, [esp + 0x10]
push edx
push 1
push esi
lea ecx, [esp + 0x24]
call fcn.00428a00
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ebp, dword [ebp]
cmp ebp, dword [eax + 0xc]
mov dword [esp + 0x10], ebp
jne 0x4292c5
cmp edi, esi
mov ebx, edi
je 0x42938a
mov ecx, dword [esp + 0x14]
mov eax, dword [ebx]
cmp eax, dword [ecx + 0xc]
je 0x429383
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push eax
mov dword [edx + 4], ecx
call fcn.0041b8fa
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x10]
add esp, 4
dec ecx
mov dword [eax + 0x10], ecx
add ebx, 4
cmp ebx, esi
jne 0x429355
test edi, edi
je 0x429397
push edi
call fcn.0041b8fa
add esp, 4
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 8

Function at 0x42b830
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x22f63561
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push 0x22f69f68
lea ecx, [esp + 0xc]
mov dword [esp + 8], esi
call dword [0x22f66244]
lea eax, [esp + 8]
push eax
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.0041b6f0
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 2
call dword [0x22f66238]
lea ecx, [esi + 0x48]
mov dword [esi], 0x22f69f64
mov dword [esi + 0x3c], 0x22f69f54
mov dword [esi + 0x40], 0
push ecx
mov dword [esi + 0x44], 0x22f671ac
call dword [0x22f660a8]
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret
Function at 0x42c259
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x22f6360c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0043d000
mov eax, dword [esp + 0x54]
xor ebx, ebx
push 0x22f6a168
lea ecx, [esp + 0x2c]
mov dword [esp + 0x50], ebx
mov dword [esi], 0x22f6a138
mov dword [esi + 0x14], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], bl
mov dword [esi + 4], eax
call dword [0x22f6622c]
push 0x22f6a12c
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], 1
call dword [0x22f6622c]
mov eax, dword [esi + 4]
push ebx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [eax + 0x14]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x58], 2
call fcn.0041f3e0
test eax, eax
setne cl
mov byte [esi + 0x24], cl
lea ecx, [esp + 0xc]
mov byte [esp + 0x4c], 1
call dword [0x22f66220]
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call dword [0x22f66220]
push 0x22f6a118
lea ecx, [esp + 0x10]
call dword [0x22f6622c]
push 0x22f6a12c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 3
call dword [0x22f6622c]
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x14]
push 0x2000
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x58], 4
call fcn.0041f3e0
lea ecx, [esp + 0x28]
mov dword [esi + 0x10], eax
mov byte [esp + 0x4c], 3
call dword [0x22f66220]
lea ecx, [esp + 0xc]
mov byte [esp + 0x4c], bl
call dword [0x22f66220]
mov ecx, dword [esp + 0x44]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x42c399
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x22f6360c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
mov dword [esp + 8], esi
call fcn.0043d000
mov eax, dword [esp + 0x58]
xor ebx, ebx
push eax
mov ecx, esi
mov dword [esp + 0x50], ebx
mov dword [esi], 0x22f6a138
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov byte [esi + 0x24], bl
call fcn.0042b990
mov eax, dword [esp + 0x54]
mov ecx, esi
mov dword [esi + 4], eax
call fcn.00438420
push 0x22f6a168
lea ecx, [esp + 0x2c]
call dword [0x22f6622c]
push 0x22f6a12c
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], 1
call dword [0x22f6622c]
mov eax, dword [esi + 4]
push ebx
lea ecx, [esp + 0x2c]
push ecx
mov ecx, dword [eax + 0x14]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x58], 2
call fcn.0041f3e0
test eax, eax
setne cl
mov byte [esi + 0x24], cl
lea ecx, [esp + 0xc]
mov byte [esp + 0x4c], 1
call dword [0x22f66220]
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], bl
call dword [0x22f66220]
push 0x22f6a118
lea ecx, [esp + 0x10]
call dword [0x22f6622c]
push 0x22f6a12c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 3
call dword [0x22f6622c]
mov ecx, dword [esi + 4]
mov ecx, dword [ecx + 0x14]
push 0x2000
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x58], 4
call fcn.0041f3e0
lea ecx, [esp + 0x28]
mov dword [esi + 0x10], eax
mov byte [esp + 0x4c], 3
call dword [0x22f66220]
lea ecx, [esp + 0xc]
mov byte [esp + 0x4c], bl
call dword [0x22f66220]
mov ecx, dword [esp + 0x44]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x48
ret 8
Function at 0x42e3f8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x22f6379d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.0041db00
xor edi, edi
mov dword [esp + 0x4c], edi
mov dword [esi + 0x10], 0x22f66d18
mov dword [esi + 0x14], edi
lea eax, [esi + 0x1c]
mov dword [esi], 0x22f6a2ec
mov dword [esi + 0x10], 0x22f6a2e4
push eax
mov dword [esi + 0x18], 0x22f671ac
call dword [0x22f660a8]
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov ecx, dword [esp + 0x54]
push edi
push edi
push edi
push edi
mov byte [esp + 0x5c], 3
mov dword [esi + 0x14], ecx
call dword [0x22f660fc]
push 0x22f6a2cc
lea ecx, [esp + 0x2c]
mov dword [esi + 0x34], eax
call dword [0x22f6622c]
push 0x22f6a2b8
lea ecx, [esp + 0x10]
mov byte [esp + 0x50], 4
call dword [0x22f6622c]
mov ecx, dword [esi + 0x14]
mov ecx, dword [ecx + 0x14]
push 1
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x14]
push eax
mov byte [esp + 0x58], 5
call fcn.0041f3e0
shl eax, 0x14
cdq
lea ecx, [esp + 0xc]
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edx
mov byte [esp + 0x4c], 4
call dword [0x22f66220]
lea ecx, [esp + 0x28]
mov byte [esp + 0x4c], 3
call dword [0x22f66220]
push 0x22f6a2a8
lea ecx, [esp + 0x10]
call dword [0x22f6622c]
push 0x22f6a2b8
lea ecx, [esp + 0x2c]
mov byte [esp + 0x50], 6
call dword [0x22f6622c]
mov ecx, dword [esi + 0x14]
mov ecx, dword [ecx + 0x14]
push 5
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
mov byte [esp + 0x58], 7
call fcn.0041f3e0
mov dword [esi + 0x58], eax
mov byte [esp + 0x4c], 6
lea ecx, [esp + 0x28]
call dword [0x22f66220]
lea ecx, [esp + 0xc]
mov byte [esp + 0x4c], 3
call dword [0x22f66220]
mov ecx, dword [esp + 0x44]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x48
ret 4
Function at 0x42fa8b
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x22f6396b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.0042f160
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x34]
mov dword [esi + 0x38], ecx
xor ebx, ebx
push eax
lea ecx, [esi + 0x40]
mov dword [esp + 0x18], ebx
mov dword [esi], 0x22f6a49c
mov dword [esi + 4], 0x22f6a494
mov dword [esi + 0x3c], edx
call dword [0x22f66228]
mov cx, word [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov word [esi + 0x5c], cx
push edx
lea ecx, [esi + 0x60]
mov byte [esp + 0x18], 1
call dword [0x22f66240]
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esi + 0x7c]
mov byte [esp + 0x18], 2
call dword [0x22f66240]
lea ecx, [esi + 0x98]
mov byte [esp + 0x14], 3
call dword [0x22f66284]
lea ecx, [esi + 0xd0]
mov byte [esp + 0x14], 4
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
call dword [0x22f66284]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov byte [esi + 0xee], bl
mov dword [esi + 0xbc], ebx
mov word [esi + 0xec], bx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x1c

Function at 0x432660
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x22f63e4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call dword [0x22f662c4]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
lea edi, [esi + 0x10]
push ecx
mov ecx, edi
mov dword [esp + 0x34], 0
mov dword [esi], 0x22f68788
mov dword [esi + 0xc], eax
call dword [0x22f66228]
push 0x22f6ab74
mov ecx, edi
mov byte [esp + 0x34], 1
call dword [0x22f66230]
lea ecx, [esp + 0xc]
call dword [0x22f66284]
mov edx, dword [esi + 0xc]
push eax
push edx
mov byte [esp + 0x38], 2
call fcn.00432460
add esp, 8
push eax
mov ecx, edi
call dword [0x22f66224]
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call dword [0x22f66220]
mov ecx, dword [esp + 0x28]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret 8

Function at 0x4481ea
Capabilities:
Encode data using xor

Disassembly:
and dl, al
cwde
and ah, al
cwde
and dh, al
cwde
and dl, byte [eax - 0x1fdd0c97]
nop
and dh, ah
invalid
Function at 0x401260
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401279
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40128d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4012ae
cmp esi, eax
jae 0x401287
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4012a0
cmp esi, eax
jae 0x401287
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401300
Capabilities:
Set current directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x435250]
mov ecx, dword [esp + 0x10c]
mov dword [esp + 0x104], eax
push 0x104
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp]
push 0x5c
push edx
call fcn.004100d0
mov byte [eax], 0
add esp, 8
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x104]
call fcn.004100bf
add esp, 0x108
ret

Function at 0x406b20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x429a20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x20]
push esi
lea eax, [esp + 0x30]
push eax
mov ecx, edi
call fcn.00404120
mov ecx, dword [esp + 0x24]
push eax
mov dword [esp + 0x1c], 0
call fcn.00405620
mov eax, dword [esp + 0x2c]
or ebx, 0xffffffff
add eax, 0xfffffff0
mov dword [esp + 0x18], ebx
lea ecx, [eax + 0xc]
mov edx, ebx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406b84
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
inc esi
push esi
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.00405960
mov ecx, dword [esp + 0x28]
push eax
mov dword [esp + 0x1c], 1
call fcn.00405620
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18], ebx
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebx
dec ebx
pop edi
pop esi
test ebx, ebx
pop ebx
jg 0x406bc6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x40a970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x429c58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call fcn.00420e63
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x28], 0
call fcn.0040a8a0
mov ebx, dword [esp + 0x14]
lea esi, [ebx - 0x10]
mov dword [esp + 0x18], esp
mov edi, esp
push esi
call fcn.00402060
add eax, 0x10
mov dword [edi], eax
mov edi, dword [esp + 0x34]
mov eax, dword [edi]
sub eax, 0x10
mov dword [esp + 0x20], esp
mov ebp, esp
push eax
mov byte [esp + 0x30], 1
call fcn.00402060
add eax, 0x10
add esp, 4
mov dword [ebp], eax
mov byte [esp + 0x2c], 0
call fcn.004057c0
add esp, 8
test eax, eax
jne 0x40aa3e
mov ebx, dword [ebx - 0xc]
inc ebx
push ebx
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
call fcn.00405960
push eax
mov ecx, edi
mov byte [esp + 0x28], 2
call fcn.00405620
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40aa3e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
push 0x2f
push 0x5c
mov ecx, edi
call fcn.00404000
mov dword [esp + 0x24], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40aa68
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret
Function at 0x40d4a0
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
push ebp
mov eax, 0x1014
lea ebp, [esp - 0xf94]
call fcn.00411fa0
mov eax, dword [0x435250]
mov ecx, dword [ebp + 0xf9c]
push ebx
push esi
push edi
push 0
push 0x8000027
push 3
push 0
push 1
mov dword [ebp + 0xf90], eax
mov eax, dword [ebp + 0xfa0]
push 0x80000000
push ecx
mov dword [ebp - 0x7c], 0
mov dword [eax], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0x78], esi
jne 0x40d50a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x7c], eax
jmp 0x40d590
push 0
lea edx, [ebp - 0x74]
push edx
push 0x1000
lea eax, [ebp - 0x70]
push eax
push esi
mov dword [ebp - 0x80], 0x434338
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d58c
jmp 0x40d530
mov eax, dword [ebp - 0x74]
test eax, eax
je 0x40d58c
push esi
push edi
mov eax, dword [ebp + 0xfa0]
mov ecx, dword [eax]
mov edi, dword [ebp - 0x80]
lea esi, [ebp - 0x70]
mov ebx, dword [ebp - 0x74]
lea edx, [esi + ebx]
xor eax, eax
mov bl, byte [esi]
mov al, cl
inc esi
xor al, bl
shr ecx, 8
mov ebx, dword [edi + eax*4]
xor ecx, ebx
cmp edx, esi
jne 0x40d54d
pop edi
pop esi
mov eax, dword [ebp + 0xfa0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x78]
push 0
lea ecx, [ebp - 0x74]
push ecx
push 0x1000
lea edx, [ebp - 0x70]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
mov esi, dword [ebp - 0x78]
jne 0x40d530
test esi, esi
je 0x40d597
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xfa0]
mov ecx, dword [eax]
not ecx
mov dword [eax], ecx
mov ecx, dword [ebp + 0xf90]
mov eax, dword [ebp - 0x7c]
call fcn.004100bf
pop edi
pop esi
pop ebx
add ebp, 0xf94
mov esp, ebp
pop ebp
ret
Function at 0x411da9
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00411fa0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x411e44
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x438914]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x411e44
cmp eax, 1
je 0x411e65
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x411e44
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x411e11
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x411e40
xor eax, eax
inc eax
jmp 0x411e84
cmp edi, eax
jae 0x411e48
xor eax, eax
jmp 0x411e84
cmp eax, esi
jae 0x411e4f
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x438914]
jmp 0x411e68
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x412026
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x18
push 0x42d498
call fcn.00412804
mov edi, 0x94
mov eax, edi
call fcn.00411fa0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x438914], ecx
mov eax, dword [esi + 4]
mov dword [0x438920], eax
mov edx, dword [esi + 8]
mov dword [0x438924], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x438918], esi
cmp ecx, 2
je 0x412086
or esi, 0x8000
mov dword [0x438918], esi
shl eax, 8
add eax, edx
mov dword [0x43891c], eax
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x4120bf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4120bf
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x4120d7
cmp eax, 0x20b
je 0x4120c4
mov dword [ebp - 0x1c], edi
jmp 0x4120eb
cmp dword [ecx + 0x84], 0xe
jbe 0x4120bf
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4120e5
cmp dword [ecx + 0x74], 0xe
jbe 0x4120bf
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00415804
pop ecx
test eax, eax
jne 0x4120ff
push 0x1c
call fcn.00412002
pop ecx
call fcn.004170e4
test eax, eax
jne 0x412110
push 0x10
call fcn.00412002
pop ecx
call fcn.00419ff9
mov dword [ebp - 4], edi
call fcn.00419dfb
test eax, eax
jge 0x412129
push 0x1b
call fcn.00411fdd
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x43a1f0], eax
call fcn.00419cd9
mov dword [0x438904], eax
call fcn.00419c37
test eax, eax
jge 0x41214f
push 8
call fcn.00411fdd
pop ecx
call fcn.00419a04
test eax, eax
jge 0x412160
push 9
call fcn.00411fdd
pop ecx
push 1
call fcn.00412e60
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, edi
je 0x412176
push eax
call fcn.00411fdd
pop ecx
mov eax, dword [0x438934]
mov dword [0x438938], eax
push eax
push dword [0x43892c]
push dword [0x438928]
call fcn.0040c7d0
add esp, 0xc
mov esi, eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x1c], edi
jne 0x4121a5
push esi
call fcn.00412f8d
call fcn.00412faf
jmp 0x4121d7
or dword [ebp - 4], 0xffffffff
mov eax, esi
lea esp, [ebp - 0x34]
call fcn.0041283f
ret
Function at 0x412eca
Capabilities:
Terminate process

Disassembly:
push 8
push 0x42d4d0
call fcn.00412804
push 8
call fcn.0041417a
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x438954], esi
jne 0x412efe
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x438950], esi
mov al, byte [ebp + 0x10]
mov byte [0x43894c], al
cmp dword [ebp + 0xc], edi
jne 0x412f48
cmp dword [0x43a1e8], edi
je 0x412f38
mov eax, dword [0x43a1e4]
sub eax, 4
mov dword [0x43a1e4], eax
cmp eax, dword [0x43a1e8]
jb 0x412f38
mov eax, dword [eax]
cmp eax, edi
je 0x412f19
call eax
jmp 0x412f19
push 0x4340ac
mov eax, 0x4340a4
call fcn.00412e48
pop ecx
push 0x4340b8
mov eax, 0x4340b0
call fcn.00412e48
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x412f79
cmp dword [ebp + 0x10], edi
jne 0x412f87
mov dword [0x438954], esi
push dword [ebp + 8]
call fcn.00412e06
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x412f86
push 8
call fcn.004140c5
pop ecx
ret
call fcn.0041283f
ret
Function at 0x417523
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x435250]
push edi
xor edi, edi
cmp dword [ebp + 0x3b0], edi
mov dword [ebp + 0x39c], eax
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x7c], edi
jne 0x417554
xor eax, eax
jmp 0x4176dd
mov eax, dword [ebp + 0x3a8]
push ebx
mov ebx, dword [ebp + 0x3a8]
and eax, 0x1f
sar ebx, 5
push esi
lea esi, [eax + eax*8]
lea ebx, [ebx*4 + 0x438e60]
mov eax, dword [ebx]
shl esi, 2
test byte [eax + esi + 4], 0x20
je 0x417590
push 2
push edi
push edi
push dword [ebp + 0x3a8]
call fcn.0041d35d
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x41766b
cmp dword [ebp + 0x3b0], edi
mov eax, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x6c], edi
jbe 0x4176a9
mov ecx, dword [ebp - 0x74]
sub ecx, dword [ebp + 0x3ac]
lea eax, [ebp - 0x68]
mov dword [ebp - 0x70], edi
cmp ecx, dword [ebp + 0x3b0]
jae 0x4175f4
mov edx, dword [ebp - 0x74]
inc dword [ebp - 0x74]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x4175e5
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc dword [ebp - 0x70]
mov byte [eax], dl
inc eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x400
jl 0x4175c5
mov edi, eax
lea eax, [ebp - 0x68]
sub edi, eax
push 0
lea eax, [ebp - 0x80]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x417634
mov eax, dword [ebp - 0x80]
add dword [ebp - 0x78], eax
cmp eax, edi
jl 0x41763d
mov eax, dword [ebp - 0x74]
sub eax, dword [ebp + 0x3ac]
xor edi, edi
cmp eax, dword [ebp + 0x3b0]
jb 0x4175b6
jmp 0x41763f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
xor edi, edi
mov eax, dword [ebp - 0x78]
cmp eax, edi
jne 0x4176d8
cmp dword [ebp - 0x6c], edi
je 0x4176a9
push 5
pop esi
cmp dword [ebp - 0x6c], esi
jne 0x41769e
call fcn.00411621
mov dword [eax], 9
call fcn.0041162a
mov dword [eax], esi
jmp 0x4176d3
push edi
lea ecx, [ebp - 0x80]
push ecx
push dword [ebp + 0x3b0]
push dword [ebp + 0x3ac]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x417693
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x78], eax
jmp 0x41763f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x6c], eax
jmp 0x41763f
push dword [ebp - 0x6c]
call fcn.00411633
pop ecx
jmp 0x4176d3
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x4176c1
mov eax, dword [ebp + 0x3ac]
cmp byte [eax], 0x1a
jne 0x4176c1
xor eax, eax
jmp 0x4176db
call fcn.00411621
mov dword [eax], 0x1c
call fcn.0041162a
mov dword [eax], edi
or eax, 0xffffffff
jmp 0x4176db
sub eax, dword [ebp - 0x7c]
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
pop edi
call fcn.004100bf
add ebp, 0x3a0
leave
ret
Function at 0x4193a6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4193c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00411633
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x4193e9
test byte [esp + 8], 2
je 0x4193e9
call fcn.00411621
mov dword [eax], 0xd
call fcn.0041162a
mov dword [eax], 5
jmp 0x4193c2
xor eax, eax
ret