joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a728
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40a7c5
push ebx
push esi
call fcn.0040a6f1
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040a685
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a772
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a7c4
push edi
push eax
call fcn.00409104
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40a792
call fcn.00409152
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40a7c3
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040a685
add esp, 0x20
test eax, eax
jne 0x40a7b1
push edi
call fcn.00409152
jmp 0x40a7b9
push ebx
call fcn.00409152
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40b783
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4132a8
push 0x4132a0
push str.FlsAlloc
push 0x1f
call fcn.0040b69f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b7b7
push dword [ebp + 8]
mov ecx, esi
call dword [0x411150]
call esi
jmp 0x40b7bd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40b801
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4132b8
push 0x4132b0
push str.FlsGetValue
push 0x21
call fcn.0040b69f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b838
push dword [ebp + 8]
mov ecx, esi
call dword [0x411150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40b840
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4132c0
push 0x4132b8
push str.FlsSetValue
push 0x22
call fcn.0040b69f
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40b87a
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x411150]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x410620
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41064d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41064d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401933
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
mov eax, 0x42683f
call fcn.004256c0
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x14]
mov byte [esi], bl
mov byte [esi + 1], bl
mov byte [esi + 2], bl
mov byte [esi + 3], bl
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
call fcn.004032ae
lea ecx, [esi + 0x20]
mov dword [ebp - 4], ebx
call fcn.0040198c
lea ecx, [esi + 0x30]
call fcn.004032ae
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x405386
Capabilities:
Set file attributes

Disassembly:
push edx
push ecx
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
test eax, eax
setne al
ret

Function at 0x405512
Capabilities:
Create directory

Disassembly:
mov eax, 0x426bd0
call fcn.004256c0
sub esp, 0x38
push ebx
push esi
xor ebx, ebx
mov esi, ecx
push ebx
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x405535
mov al, 1
jmp 0x40557b
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0xb7
je 0x405546
xor al, al
jmp 0x40557b
lea ecx, [ebp - 0x44]
call fcn.0040573f
lea ecx, [ebp - 0x1c]
call fcn.004032ae
push ebx
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], ebx
call fcn.0040598d
test al, al
je 0x405570
mov ebx, dword [ebp - 0x24]
shr ebx, 4
and bl, 1
push dword [ebp - 0x1c]
call fcn.00403a73
pop ecx
mov al, bl
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40597e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40598c
or eax, eax
ret

Function at 0x406d48
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x406d57
pop dword [ebp - 0x18]
mov eax, 0x406d57
sub dword [ebp - 0x18], eax
push 0x40
push 0x1000
push 0x3b1e6
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x18]
call dword [eax]
mov ecx, 0x8d96a510
sub ecx, 0x8d9654a9
mov esi, eax
mov edi, 0xaa4df59d
add edi, 0x55f57863
add edi, dword [ebp - 0x18]
mov ebx, 0xfb77c463
sub dword [ebp - 0x14], edx
mov edx, dword [edi]
add dword [ebp - 0x14], 0xa969ef5d
add edx, ebx
sub dword [ebp - 4], 0xa434189f
mov dword [esi], edx
xor dword [ebp - 8], 0x817dceff
add esi, 0x70342a0c
add esi, 0x8fcbd5f8
add edi, 0xf1ed38ed
sub edi, 0xf1ed38e9
loop 0x406da6
add eax, 0x1346f
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x425a8c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42bb98
push 0x425a86
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
and dword [ebp - 4], 0
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x43466c], 0xffffffff
or dword [0x434670], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x432650]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x43264c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x434668], eax
call fcn.00425bcf
cmp dword [0x430240], 0
jne 0x425b0f
push 0x425bcc
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.00425bba
push 0x430064
push 0x430060
call sub.msvcrt.dll__initterm
mov eax, dword [0x432648]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x432644]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
push 0x43005c
push section..data
call sub.msvcrt.dll__initterm
call dword [sym.imp.msvcrt.dll___p___initenv]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
push dword [ebp - 0x20]
push dword [ebp - 0x2c]
push dword [ebp - 0x1c]
call fcn.00411c13
add esp, 0x30
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x30], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret

Function at 0x401000
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x40338c], eax
mov eax, dword [ebp + 4]
mov dword [0x403210], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401020
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x403210]
mov dword [ebp - 0x48], eax
mov eax, 0x4016c9
mov dword [ebp - 0x54], eax
mov ecx, str.Hello
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
xor ecx, ecx
push ecx
push dword [0x403210]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.lukifas
push eax
mov eax, str.Hello
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4033d8], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4033d8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4010bc
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4010b5
mov esp, ebp
ret
Function at 0x401102
Capabilities:
Terminate process

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push ecx
sub esp, 0x44
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x18
mov eax, dword [ebp - 0x18]
mov eax, dword fs:[eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0
jmp 0x40115e
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x40114d
mov dword [ebp - 0xc], 1
jmp 0x401188
mov dword [esp], 0x3e8
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x410b08
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x20]
lock cmpxchg dword [edx], ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40113c
mov eax, dword [0x410b0c]
cmp eax, 1
jne 0x4011a0
mov dword [esp], 0x1f
call sym.__amsg_exit
jmp 0x4011d3
mov eax, dword [0x410b0c]
test eax, eax
jne 0x4011c9
mov dword [0x410b0c], 1
mov dword [esp + 4], 0x413014
mov dword [esp], 0x41300c
call sym.__initterm
jmp 0x4011d3
mov dword [0x41001c], 1
mov eax, dword [0x410b0c]
cmp eax, 1
jne 0x4011fb
mov dword [esp + 4], 0x413008
mov dword [esp], section..CRT
call sym.__initterm
mov dword [0x410b0c], 2
cmp dword [ebp - 0xc], 0
jne 0x401217
mov dword [ebp - 0x2c], 0x410b08
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
xchg dword [eax], edx
mov eax, dword [entry1]
test eax, eax
je 0x401241
mov eax, dword [entry1]
mov dword [esp + 8], 0
mov dword [esp + 4], 2
mov dword [esp], 0
call eax
sub esp, 0xc
call sym.__pei386_runtime_relocator
mov dword [esp], sym.__gnu_exception_handler_4
mov eax, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call eax
sub esp, 4
mov dword [0x410114], eax
mov dword [esp], sym.___mingw_invalidParameterHandler
call sym.__set_invalid_parameter_handler
call sym.__fpreset
mov eax, dword [0x410004]
mov dword [esp + 4], 0x410008
mov dword [esp], eax
call sym._duplicate_ppstrings
call sym.___main
mov eax, dword [0x40b064]
mov edx, dword [0x41000c]
mov dword [eax], edx
mov ecx, dword [0x41000c]
mov edx, dword [0x410008]
mov eax, dword [0x410004]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._main
mov dword [0x410014], eax
mov eax, dword [0x410018]
test eax, eax
jne 0x4012d0
mov eax, dword [0x410014]
mov dword [esp], eax
call sym._exit
mov eax, dword [0x41001c]
test eax, eax
jne 0x4012de
call sym.__cexit
mov eax, dword [0x410014]
mov ecx, dword [ebp - 4]
leave
lea esp, [ecx - 4]
ret
Function at 0x4012eb
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x4100ec], 1
mov dword [0x4100f0], 1
mov dword [0x4100f4], 1
mov dword [ebp - 4], 0x400000
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x40132c
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x40134f
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
movzx eax, ax
cmp eax, 0x10b
je 0x401371
cmp eax, 0x20b
je 0x401396
jmp 0x4013c1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x5c]
cmp eax, 0xe
ja 0x401383
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x6c]
cmp eax, 0xe
ja 0x4013ae
mov eax, 0
jmp 0x4013c6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x4013c6
mov eax, 0
leave
ret

Function at 0x402d10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort

Function at 0x4038e4
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x403903
mov eax, 0
jmp 0x403947
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x403926
mov eax, 0
jmp 0x403947
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x403942
mov eax, 0
jmp 0x403947
mov eax, 1
leave
ret
Function at 0x403949
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x4039a8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x4039a0
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x4039a0
mov eax, dword [ebp - 4]
jmp 0x4039bc
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x40397d
mov eax, 0
leave
ret
Function at 0x403cc0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea edx, [esp + 0x2c]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
sub esp, 8
test eax, eax
je 0x403dcf
mov edi, eax
mov eax, dword [esp + 0x2c]
lea ebx, [eax*4 + 4]
mov eax, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x14], eax
call eax
mov dword [esp + 8], ebx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 4], 8
mov dword [esp + 0x1c], eax
call eax
sub esp, 0xc
mov dword [esp + 0x18], eax
test eax, eax
je 0x403dcf
mov edx, dword [esp + 0x2c]
test edx, edx
jle 0x403e07
xor ebp, ebp
jmp 0x403d97
mov dword [esp], eax
call sym._SDL_strlen
mov ebx, eax
mov eax, dword [esp + 0x14]
call eax
lea ecx, [ebx + 1]
mov dword [esp + 4], 8
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ecx
call eax
sub esp, 0xc
mov edx, dword [esp + 0x18]
mov dword [edx + ebp*4], eax
test eax, eax
je 0x403dcf
mov dword [esp + 8], ebx
add ebp, 1
mov dword [esp + 4], esi
mov dword [esp], eax
call sym._SDL_memcpy
mov dword [esp], esi
call sym._SDL_free
cmp dword [esp + 0x2c], ebp
jle 0x403e00
mov eax, dword [edi + ebp*4]
mov dword [esp], eax
call sym._SDL_wcslen
lea eax, [eax + eax + 2]
mov dword [esp + 0xc], eax
mov eax, dword [edi + ebp*4]
mov dword [esp + 4], str.UTF_16LE
mov dword [esp + 8], eax
mov dword [esp], str.UTF_8
call sym._SDL_iconv_string
mov esi, eax
test eax, eax
jne 0x403d40
mov dword [esp + 0xc], 0
xor edi, edi
mov dword [esp + 8], str.Out_of_memory___aborting
mov dword [esp + 4], str.Fatal_Error
mov dword [esp], 0x10
call sym._SDL_ShowSimpleMessageBox
add esp, 0x3c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x18]
lea eax, [eax + ebp*4]
mov dword [eax], 0
xor ebx, ebx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
sub esp, 4
call sym._SDL_SetMainReady
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._SDL_main
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, eax
mov eax, dword [esp + 0x2c]
test eax, eax
jle 0x403e7b
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x1c], edi
mov edi, ebx
nop
mov ebx, dword [ebp + edi*4]
mov eax, dword [esp + 0x14]
add edi, 1
call eax
mov dword [esp + 4], 0
mov dword [esp + 8], ebx
mov dword [esp], eax
call esi
sub esp, 0xc
cmp dword [esp + 0x2c], edi
jg 0x403e50
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
call eax
mov ecx, dword [esp + 0x18]
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 8], ecx
call esi
mov eax, edi
sub esp, 0xc
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4022e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0040e0ab
Function at 0x404000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5398a8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x599808]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.0040e7a1
push 0
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_GetSystemMenu]
push eax
call fcn.00412654
mov edi, eax
mov dword [ebp - 0x14], edi
test edi, edi
je 0x4040de
call fcn.0040b12a
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x404069
push 0x80004005
call fcn.004014e0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
push 0x65
mov dword [ebp - 4], 0
call fcn.00411bd9
test eax, eax
je 0x404096
push 0x65
push eax
lea ecx, [ebp - 0x10]
call fcn.00403950
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], 0
je 0x4040bd
push 0
push 0
push 0x800
push dword [edi + 4]
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
call edi
mov eax, dword [ebp - 0x14]
push esi
push 0x10
push 0
push dword [eax + 4]
call edi
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4040de
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx + 0x1578]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0x80
push dword [ebx + 0x20]
call esi
push dword [ebx + 0x1578]
push 0
push 0x80
push dword [ebx + 0x20]
call esi
call fcn.004066f0
mov ecx, ebx
test eax, eax
jne 0x40412c
push 0x10
push str.NetDatabaseScanner
push str.Network_initialization_failed
call fcn.004150f4
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.00403350
mov ecx, ebx
call fcn.00404c90
push 0
push 0
push 0
push 0
push ebx
push 0x4057a0
call fcn.0040ef7a
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404c90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
mov eax, dword [0x599808]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x3f8]
push eax
push 0x20019
push 0
push str.SoftwareSecurityXplodedNetDatabaseScanner
push SysReAllocString
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x404cdd
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051eae1
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x3fc]
push eax
push 0
push str.SingleHost
push dword [ebp - 0x3f8]
mov dword [ebp - 0x3f0], 4
call ebx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x404d78
cmp dword [ebp - 0x400], 1
push 0
jne 0x404d51
push 0
push 0xf1
push dword [esi + 0x138]
call edi
push 0
push 1
push 0xf1
push dword [esi + 0xc4]
call edi
mov ecx, esi
call fcn.004045c0
jmp 0x404d78
push 1
push 0xf1
push dword [esi + 0x138]
call edi
push 0
push 0
push 0xf1
push dword [esi + 0xc4]
call edi
mov ecx, esi
call fcn.00404590
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3fc]
push eax
push 0
push str.StartHostAddress
push dword [ebp - 0x3f8]
mov dword [ebp - 0x3f0], 0x3e8
call ebx
test eax, eax
jne 0x404dbd
lea eax, [ebp - 0x3ec]
push eax
push 0x3ec
mov ecx, esi
call fcn.0041906f
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x3fc]
push eax
push 0
push str.EndHostAddress
push dword [ebp - 0x3f8]
mov dword [ebp - 0x3f0], 0x3e8
mov byte [ebp - 0x3ec], 0
call ebx
test eax, eax
jne 0x404e09
lea eax, [ebp - 0x3ec]
push eax
push 0x3eb
mov ecx, esi
call fcn.0041906f
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0x3f4]
push eax
lea eax, [ebp - 0x3fc]
push eax
push 0
push str.DatabaseType
push dword [ebp - 0x3f8]
mov dword [ebp - 0x3f4], 0
mov dword [ebp - 0x3f0], 4
call ebx
test eax, eax
jne 0x404ee7
test byte [ebp - 0x3f4], 1
push eax
je 0x404e57
push 1
jmp 0x404e59
push 0
push 0xf1
push dword [esi + 0x27c0]
call edi
test byte [ebp - 0x3f4], 0x10
push 0
je 0x404e75
push 1
jmp 0x404e77
push 0
push 0xf1
push dword [esi + 0x2834]
call edi
test dword [ebp - 0x3f4], 0x100
push 0
je 0x404e96
push 1
jmp 0x404e98
push 0
push 0xf1
push dword [esi + 0x28a8]
call edi
test dword [ebp - 0x3f4], 0x10000
push 0
je 0x404eb7
push 1
jmp 0x404eb9
push 0
push 0xf1
push dword [esi + 0x291c]
call edi
test dword [ebp - 0x3f4], 0x1000
push 0
je 0x404ed8
push 1
jmp 0x404eda
push 0
push 0xf1
push dword [esi + 0x2990]
call edi
push dword [ebp - 0x3f8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.0051eae1
mov esp, ebp
pop ebp
ret