joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14f6e10
Capabilities:
Set socket configuration

Disassembly:
push 0xffffffffffffffff
push 0x155bae8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp esi, edi
jne 0x14f6e56
mov eax, 0x8009
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
lea ecx, [esi + 4]
cmp ecx, edi
jne 0x14f6e68
call fcn.014f2810
mov ebp, dword [esp + 0x1c]
jmp 0x14f6e86
mov ebp, ecx
mov dword [esp + 0x1c], ebp
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
mov dword [esp + 0x20], eax
mov eax, dword [edx + 4]
push 0xffffffffffffffff
mov dword [esp + 0x28], edi
call eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], edi
mov ecx, dword [esi + 0x148]
cmp ecx, edi
je 0x14f6ee6
cmp dword [0x15b15e4], edi
je 0x14f6ee6
push 1
mov dword [esp + 0x14], edi
mov edx, dword [ecx]
mov edx, dword [edx + 0x18]
push edi
lea eax, [esp + 0x18]
push eax
call edx
mov ecx, dword [esp + 0x10]
cmp ecx, edi
je 0x14f6ee6
mov eax, dword [0x15b15e4]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x50]
call eax
mov ecx, dword [esi + 0x148]
push 1
mov dword [esp + 0x14], edi
mov edx, dword [ecx]
mov edx, dword [edx + 0x18]
push edi
lea eax, [esp + 0x18]
push eax
call edx
mov ecx, dword [esp + 0x10]
cmp ecx, edi
jne 0x14f6eb7
cmp dword [esi + 0x44], 1
jne 0x14f6f74
mov eax, dword [esi + 0x40]
cmp eax, 0xffffffff
je 0x14f6f6d
cmp dword [esi + 0x48], edi
je 0x14f6f38
push edi
push eax
call fcn.015159e0
mov eax, dword [esi + 0x40]
add esp, 8
push 1
push eax
call dword [sym.imp.WS2_32.dll_shutdown]
mov edx, dword [esi + 0x40]
push edi
push edi
lea ecx, [esp + 0x20]
push ecx
push 4
push edi
push edi
push edi
push 0x4004667f
push edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
jmp 0x14f6f5c
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x80
push 0xffff
push eax
mov word [esp + 0x24], 1
mov word [esp + 0x26], di
call dword [sym.imp.WS2_32.dll_setsockopt]
mov edx, dword [esi + 0x40]
push edx
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x44], 0xffffffff
cmp dword [0x15b15e8], edi
jne 0x14f6f83
mov ecx, esi
call fcn.014f6b30
mov dword [esp + 0x30], 0xffffffff
cmp ebp, edi
jne 0x14f6f94
call fcn.014f2810
cmp dword [esp + 0x24], edi
je 0x14f6faf
mov eax, dword [ebp]
mov edx, dword [eax + 0xc]
mov ecx, ebp
call edx
neg eax
sbb eax, eax
add eax, 1
mov dword [esp + 0x24], eax
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
Function at 0x14fb9f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x50]
mov ecx, edi
call fcn.014f4d50
mov eax, dword [edi + 0x38]
cmp eax, dword [edi + 0x3c]
jge 0x14fba0f
call fcn.014f2810
mov ecx, dword [edi + 0x38]
sub ecx, dword [edi + 0x3c]
cmp ecx, 6
jl 0x14fba1f
call fcn.014f2810
mov ecx, edi
call fcn.014f4bf0
cmp dword [esi + 0x74], 0
lea ebx, [esi + 0x74]
ja 0x14fba34
call fcn.014f2810
push 0
push edi
lea eax, [esi + 0xc8]
push eax
mov dword [eax], 0x10
lea edx, [esi + 0xb8]
push edx
mov edx, dword [esi + 0x70]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0x40]
lea ecx, [esp + 0x24]
push ecx
push edx
push ebx
push eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
jne 0x14fbaae
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x14fbaae
cmp eax, 0x2733
je 0x14fbaa5
cmp eax, 8
je 0x14fbaa5
cmp eax, 0x2747
je 0x14fbaa5
mov eax, 0x8002
add esp, 8
ret
mov eax, 0x8005
add esp, 8
ret
xor eax, eax
add esp, 8
ret

Function at 0x14fb9f4
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x50]
mov ecx, edi
call fcn.014f4d50
mov eax, dword [edi + 0x38]
cmp eax, dword [edi + 0x3c]
jge 0x14fba0f
call fcn.014f2810
mov ecx, dword [edi + 0x38]
sub ecx, dword [edi + 0x3c]
cmp ecx, 6
jl 0x14fba1f
call fcn.014f2810
mov ecx, edi
call fcn.014f4bf0
cmp dword [esi + 0x74], 0
lea ebx, [esi + 0x74]
ja 0x14fba34
call fcn.014f2810
push 0
push edi
lea eax, [esi + 0xc8]
push eax
mov dword [eax], 0x10
lea edx, [esi + 0xb8]
push edx
mov edx, dword [esi + 0x70]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0x40]
lea ecx, [esp + 0x24]
push ecx
push edx
push ebx
push eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
pop edi
pop esi
pop ebx
jne 0x14fbaae
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x3e5
je 0x14fbaae
cmp eax, 0x2733
je 0x14fbaa5
cmp eax, 8
je 0x14fbaa5
cmp eax, 0x2747
je 0x14fbaa5
mov eax, 0x8002
add esp, 8
ret
mov eax, 0x8005
add esp, 8
ret
xor eax, eax
add esp, 8
ret
Function at 0x14fc700
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x40], 0xffffffff
mov byte [esi + 0xa8], 1
jne 0x14fc73f
push 1
push 0
push 0
push 0x11
push 2
push 2
call dword [sym.imp.WS2_32.dll_WSASocketA]
cmp eax, 0xffffffff
mov dword [esi + 0x40], eax
jne 0x14fc73f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
mov ecx, esi
call edx
xor eax, eax
pop esi
ret 4
push ebp
mov ebp, dword [esp + 0xc]
xor eax, eax
test bp, bp
push edi
lea edi, [esi + 0xb8]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov word [edi], 2
jbe 0x14fc782
mov ecx, dword [esi + 0x40]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0xffff
push ecx
mov dword [esp + 0x24], 1
call dword [sym.imp.WS2_32.dll_setsockopt]
push ebp
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi + 0x40]
push 0x10
push edi
push edx
mov word [esi + 0xba], ax
mov dword [esi + 0xbc], 0
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
pop edi
pop ebp
jne 0x14fc7ba
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
xor eax, eax
pop esi
ret 4
mov ecx, esi
call fcn.014fb890
test eax, eax
je 0x14fc739
mov ecx, esi
call fcn.014fc630
mov eax, 1
pop esi
ret 4

Function at 0x14fc850
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x10
cmp byte [0x15b15e0], 0
jne 0x14fc8b2
lea eax, [esp]
push eax
push 1
mov byte [0x15b15e0], 1
call fcn.014fc810
add esp, 8
test al, al
je 0x14fc889
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [0x15b15d0], ecx
mov dword [0x15b15d4], edx
lea eax, [esp]
push eax
push reloc.WS2_32.dll_accept
call fcn.014fc810
add esp, 8
test al, al
je 0x14fc8b2
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [0x15b15d8], ecx
mov dword [0x15b15dc], edx
mov ecx, dword [esp + 0x14]
mov edx, ecx
sar edx, 5
cmp edx, 3
jbe 0x14fc8d1
push str.cap_invalid
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
add esp, 0x10
ret
and ecx, 0x1f
mov eax, 1
shl eax, cl
and eax, dword [edx*4 + 0x15b15d0]
neg eax
sbb eax, eax
neg eax
add esp, 0x10
ret
Function at 0x15000b0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x15806c0
push 0x152b130
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x2804
call fcn.0152b360
mov eax, dword [0x158aa80]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0x281c], bl
push 0x27ff
push ebx
lea eax, [ebp - 0x281b]
push eax
call fcn.0152a100
add esp, 0xc
lea ecx, [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x2800
lea eax, [ebp - 0x281c]
push eax
call fcn.014895a0
test eax, eax
je 0x1500132
call fcn.014f2810
mov eax, dword [0x15b15e4]
cmp eax, ebx
je 0x1500159
mov eax, dword [eax + 0x24]
cmp eax, ebx
je 0x1500159
lea ecx, [ebp - 0x281c]
push ecx
push 0x1567010
mov edx, dword [ebp + 8]
push edx
call eax
add esp, 0xc
jmp 0x1500171
lea eax, [ebp - 0x281c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x1500171
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.01529f5a
mov esp, ebp
pop ebp
ret
Function at 0x1515804
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x158aa80]
xor eax, esp
mov dword [esp + 0x190], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x151582a
mov eax, 1
pop esi
mov ecx, dword [esp + 0x190]
xor ecx, esp
call fcn.01529f5a
add esp, 0x194
ret 8
xor ecx, ecx
mov ch, byte [esp + 0x1a0]
push ebx
mov bl, byte [esp + 0x1a0]
lea eax, [esp + 8]
push eax
mov cl, bl
push ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x151586f
mov ax, word [esp + 8]
cmp al, bl
jne 0x1515869
cmp ah, byte [esp + 0x1a4]
jne 0x1515869
mov eax, 1
mov dword [esi + 4], eax
jmp 0x1515871
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov ecx, dword [esp + 0x198]
pop ebx
pop esi
xor ecx, esp
call fcn.01529f5a
add esp, 0x194
ret 8
Function at 0x15167f0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
push edi
mov edi, dword [esp + 0x14]
cmp esi, edi
sete al
mov ebx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
test eax, eax
jbe 0x1516884
push ebp
lea ebp, [eax - 1]
shr ebp, 3
add ebp, 1
lea ebx, [ebx]
cmp dword [esp + 0x14], 0
je 0x1516838
lea ecx, [esi + 4]
push ecx
push esi
mov ecx, ebx
call fcn.01515ea0
add esi, 8
jmp 0x151687e
movzx edx, byte [esi]
mov byte [edi], dl
mov al, byte [esi + 1]
mov byte [edi + 1], al
movzx ecx, byte [esi + 2]
mov byte [edi + 2], cl
movzx edx, byte [esi + 3]
mov byte [edi + 3], dl
movzx ecx, byte [esi + 4]
lea eax, [edi + 4]
mov byte [eax], cl
movzx edx, byte [esi + 5]
mov byte [edi + 5], dl
movzx ecx, byte [esi + 6]
mov byte [edi + 6], cl
movzx edx, byte [esi + 7]
push eax
push edi
mov ecx, ebx
mov byte [edi + 7], dl
call fcn.01515ea0
add esi, 8
add edi, 8
sub ebp, 1
jne 0x1516820
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x15169a0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x15f16a8], 1
push esi
mov esi, ecx
je 0x15169b1
call fcn.014f2810
cmp dword [esi], 0
jne 0x15169bb
call fcn.014f2810
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x15169c9
xor al, al
pop esi
ret 8
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
mov dword [esi + 4], 0xffffffff
jbe 0x1516a06
push edi
mov edi, dword [esi]
shl edi, 8
nop
movzx edx, byte [ecx]
mov eax, dword [esi + 4]
xor edx, eax
and edx, 0xff
add edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x15b16a8]
add ecx, 1
sub ebp, 1
mov dword [esi + 4], eax
jne 0x15169e0
pop edi
pop ebp
mov al, 1
pop esi
ret 8

Function at 0x1516d72
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
call edx
cmp eax, 1
je 0x1516d86
call fcn.014f2810
mov ebx, dword [esp + 0x18]
test ebx, ebx
jne 0x1516d96
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0xc
push edi
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x1516da4
call fcn.014f2810
mov eax, dword [esp + 0x14]
push eax
mov ecx, esi
call fcn.01516d20
test eax, eax
jne 0x1516dbb
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
mov edx, dword [esi + 0x98]
push 0
lea ecx, [esp + 0x10]
push ecx
push ebx
push edi
push edx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, esi
call fcn.01516d50
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x1519430
Capabilities:
Hash data using fnv

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
mov ebp, 0x811c9dc5
cmp esi, 0xfffffffe
je 0x1519455
test esi, esi
je 0x1519450
cmp esi, dword [esp + 0x1c]
je 0x1519455
call fcn.015298ac
cmp edi, dword [esp + 0x20]
je 0x15194c1
cmp esi, 0xfffffffe
mov ebx, edi
je 0x1519487
test esi, esi
jne 0x151946b
call fcn.015298ac
cmp dword [esi + 0x18], 0x10
jb 0x1519476
mov eax, dword [esi + 4]
jmp 0x1519479
lea eax, [esi + 4]
mov ecx, dword [esi + 0x14]
add ecx, eax
cmp edi, ecx
jb 0x1519487
call fcn.0152986d
add edi, 1
cmp esi, 0xfffffffe
je 0x15194b4
test esi, esi
jne 0x1519498
call fcn.015298ac
cmp dword [esi + 0x18], 0x10
jb 0x15194a3
mov eax, dword [esi + 4]
jmp 0x15194a6
lea eax, [esi + 4]
mov edx, dword [esi + 0x14]
add edx, eax
cmp ebx, edx
jb 0x15194b4
call fcn.0152986d
movsx eax, byte [ebx]
imul ebp, ebp, 0x1000193
xor ebp, eax
jmp 0x1519441
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
ret

Function at 0x15201f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x155ffc9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov dword [esi], vtable.IFile.0
mov dword [esp + 0x1c], 2
call fcn.0151ec60
mov byte [esp + 0x1c], 1
lea ecx, [esi + 0x58]
call fcn.01491710
xor ebx, ebx
mov byte [esp + 0x1c], bl
lea ecx, [esi + 0x30]
mov dword [esp + 0x10], ecx
mov byte [esp + 0x1c], bl
call fcn.01519c20
mov dword [esp + 0x1c], 0xffffffff
cmp dword [esi + 0x2c], 0x10
jb 0x152026b
mov eax, dword [esi + 0x18]
push eax
call fcn.0152a023
add esp, 4
mov dword [esi + 0x2c], 0xf
mov dword [esi + 0x28], ebx
mov byte [esi + 0x18], bl
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x14
ret

Function at 0x1522730
Capabilities:
Set registry value

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x152273c
xor al, al
ret 8
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
add eax, 1
ret 8

Function at 0x15227d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [ecx + 4]
sub esp, 8
test eax, eax
jne 0x15227e2
xor al, al
add esp, 8
ret 8
mov edx, dword [esp + 0x10]
mov ecx, 4
mov dword [esp], ecx
mov dword [esp + 4], ecx
lea ecx, [esp]
push ecx
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
add eax, 1
add esp, 8
ret 8
Function at 0x1529210
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x1529254
cmp dword [esi + 0x18], 1
jne 0x1529254
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x1529234
pop esi
xor eax, eax
pop ebx
ret
cmp eax, 1
jbe 0x152924d
push edi
lea edi, [eax - 1]
test edi, edi
jbe 0x152924c
mov eax, dword [esi + 0x14]
push eax
call ebx
sub edi, 1
jne 0x1529241
pop edi
mov dword [esi + 0x18], 0
pop esi
mov eax, 1
pop ebx
ret

Function at 0x1529260
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x15292a9
cmp dword [esi + 0x18], 0
jne 0x15292a9
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1529287
mov dword [esi + 0x18], 0
xor eax, eax
pop esi
ret
test eax, eax
jbe 0x15292a2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
mov edi, eax
mov eax, dword [esi + 0x14]
push eax
call ebx
sub edi, 1
jne 0x1529295
pop edi
pop ebx
mov dword [esi + 0x18], 1
mov eax, 1
pop esi
ret

Function at 0x15292d0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x1529317
cmp byte [esi + 4], 0xb8
push edi
lea edi, [esi + 4]
je 0x15292e8
call fcn.014f2810
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
lea eax, [esi + 0x1c]
push eax
push 4
push ecx
push edi
push edx
push 0
call fcn.0152de5f
add esp, 0x18
test eax, eax
mov dword [esi + 0x14], eax
pop edi
je 0x1529320
mov ecx, dword [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, 1
pop esi
ret 0xc
xor eax, eax
pop esi
ret 0xc

Function at 0x15295b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x15611f3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x158aa80]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.01529560
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [esi], vtable.CThreadControl.0
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
push 0xfa0
mov dword [esi + 0x30], eax
push edi
lea ecx, [esi + 0x44]
mov dword [esi + 0x2c], 0xffffffff
call fcn.0150deb0
mov eax, 1
mov byte [esp + 0x18], al
mov dword [esi + 0x40], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esp + 0x18], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret

Function at 0x1529f5a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x158aa80]
jne 0x1529f64
repz ret
jmp fcn.0152fa1c
Function at 0x153242a
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x158ad10]
je 0x1532445
inc edi
cmp edi, 0x17
jb 0x1532436
cmp edi, 0x17
jae 0x15325c5
push ebp
push 3
call fcn.015422f5
cmp eax, 1
pop ecx
je 0x1532591
push 3
call fcn.015422f5
test eax, eax
pop ecx
jne 0x1532479
cmp dword [0x158ab20], 1
je 0x1532591
cmp ebx, 0xfc
je 0x15325c4
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x15f1c18
push ebp
call fcn.0152ba4a
add esp, 0xc
test eax, eax
je 0x15324af
push esi
push esi
push esi
push esi
push esi
call fcn.0152d65b
add esp, 0x14
push 0x104
mov esi, 0x15f1c31
push esi
push 0
mov byte [0x15f1d35], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x15324f3
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0152ba4a
add esp, 0xc
test eax, eax
je 0x15324f3
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0152d65b
add esp, 0x14
push esi
call fcn.0152df10
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1532538
push esi
call fcn.0152df10
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x15f1f2c
push 0x156d358
sub ecx, eax
push ecx
push eax
call fcn.01534d0a
add esp, 0x14
test eax, eax
je 0x1532538
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0152d65b
add esp, 0x14
jmp 0x153253a
xor esi, esi
push 0x156ac40
push ebx
push ebp
call fcn.01542284
add esp, 0xc
test eax, eax
je 0x153255a
push esi
push esi
push esi
push esi
push esi
call fcn.0152d65b
add esp, 0x14
push dword [edi*8 + 0x158ad14]
push ebx
push ebp
call fcn.01542284
add esp, 0xc
test eax, eax
je 0x153257c
push esi
push esi
push esi
push esi
push esi
call fcn.0152d65b
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.015420c7
add esp, 0xc
jmp 0x15325c4
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x15325c4
cmp ebp, 0xffffffff
je 0x15325c4
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x158ad14]
push dword [esi]
call fcn.0152df10
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x15420c7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0152f3ab
xor ebx, ebx
cmp dword [0x15f2304], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x154219d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x154227d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x156e430
push edi
call esi
cmp eax, ebx
je 0x154227d
push eax
call fcn.0152f33d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x15f2304], eax
call esi
push eax
call fcn.0152f33d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x15f2308], eax
call esi
push eax
call fcn.0152f33d
mov dword [0x15f230c], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0153204a
test eax, eax
pop ecx
pop ecx
je 0x154216b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0152d65b
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x154219d
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0152f33d
cmp eax, ebx
pop ecx
mov dword [0x15f2314], eax
je 0x154219d
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0152f33d
pop ecx
mov dword [0x15f2310], eax
mov eax, dword [0x15f2310]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x1542222
cmp dword [0x15f2314], ecx
je 0x1542222
push eax
call fcn.0152f3b4
push dword [0x15f2314]
mov esi, eax
call fcn.0152f3b4
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x1542222
cmp edi, ebx
je 0x1542222
call esi
cmp eax, ebx
je 0x15421ef
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x15421ef
test byte [ebp - 0x18], 1
jne 0x1542222
lea eax, [ebp - 0x10]
push eax
call fcn.015320f9
test eax, eax
pop ecx
je 0x154220a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0152d65b
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x1542219
or dword [ebp + 0x10], 0x200000
jmp 0x154225d
or dword [ebp + 0x10], 0x40000
jmp 0x154225d
mov eax, dword [0x15f2308]
cmp eax, dword [ebp - 8]
je 0x154225d
push eax
call fcn.0152f3b4
cmp eax, ebx
pop ecx
je 0x154225d
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x154225d
mov eax, dword [0x15f230c]
cmp eax, dword [ebp - 8]
je 0x154225d
push eax
call fcn.0152f3b4
cmp eax, ebx
pop ecx
je 0x154225d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x15f2304]
call fcn.0152f3b4
cmp eax, ebx
pop ecx
je 0x154227d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x154227f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret