joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e320
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4265cb
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x434020]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x18], bl
mov byte [esi + 0x19], bl
mov byte [esi + 0x1a], bl
mov dword [esi], vtable.ksNcDrawMgr.0
mov dword [esi + 0x1c], ebx
call fcn.004204e0
mov dword [esi + 0x2c], eax
mov byte [eax + 0x15], 1
mov eax, dword [esi + 0x2c]
mov dword [eax + 4], eax
mov eax, dword [esi + 0x2c]
mov dword [eax], eax
mov eax, dword [esi + 0x2c]
mov dword [eax + 8], eax
mov dword [esi + 0x30], ebx
mov eax, 0x1000
mov dword [esp + 0x14], ebx
mov ecx, esi
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
call fcn.0041f5f0
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4206b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp + 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
jne 0x4206d3
mov eax, dword [ebp - 4]
jmp 0x4207af
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
shr ecx, 3
xor eax, 0xffffffff
test ecx, ecx
je 0x42078a
push ebp
mov ebp, ecx
xor edx, edx
xor ecx, ecx
lea ecx, [ecx]
mov ebx, dword [esi]
add esi, 4
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x429e78]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x429e78]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x429e78]
mov cl, bh
xor eax, edi
mov ebx, dword [esi]
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x429e78]
add esi, 4
xor eax, edi
mov dl, bl
mov cl, bh
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x429e78]
shr ebx, 0x10
xor eax, edi
xor cl, al
shr eax, 8
mov edi, dword [ecx*4 + 0x429e78]
mov dl, bl
xor eax, edi
xor dl, al
shr eax, 8
mov edi, dword [edx*4 + 0x429e78]
mov cl, bh
xor eax, edi
xor cl, al
shr eax, 8
xor eax, dword [ecx*4 + 0x429e78]
dec ebp
jne 0x4206f4
pop ebp
mov ecx, dword [ebp + 0x10]
xor edx, edx
and ecx, 7
je 0x4207a6
mov dl, byte [esi]
inc esi
xor dl, al
shr eax, 8
xor eax, dword [edx*4 + 0x429e78]
dec ecx
jne 0x420794
xor eax, 0xffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x421090
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x70
mov eax, dword [0x434020]
xor eax, esp
mov dword [esp + 0x6c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x7c]
push esi
push edi
xor ebx, ebx
push 0x50
lea eax, [esp + 0x1c]
push ebx
push eax
mov esi, ecx
mov edi, edx
mov dword [esp + 0x20], ebx
call sub.MSVCR80.dll_memset
xor eax, eax
add esp, 0xc
cmp esi, ebx
mov byte [esp + 0x6c], bl
mov dword [esp + 0x6d], eax
mov dword [esp + 0x71], eax
mov dword [esp + 0x75], eax
mov word [esp + 0x79], ax
mov byte [esp + 0x7b], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0x1c], 0xefcdab89
mov dword [esp + 0x20], 0x98badcfe
mov dword [esp + 0x24], 0x10325476
jle 0x42111e
push ebx
push esi
lea ecx, [esp + 0x18]
push ecx
lea eax, [esi*8]
mov ecx, esi
mov edx, edi
call fcn.00420f00
lea edi, [esp + 0x6c]
lea esi, [esp + 0x10]
call fcn.00420fb0
mov edx, dword [esp + 0x6c]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x74]
mov dword [ebp], edx
mov edx, dword [esp + 0x78]
pop edi
mov dword [ebp + 4], eax
mov dword [ebp + 8], ecx
mov ecx, dword [esp + 0x78]
pop esi
mov dword [ebp + 0xc], edx
pop ebp
pop ebx
xor ecx, esp
call fcn.00424bfa
add esp, 0x70
ret
Function at 0x421160
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push edi
push ebx
push ebp
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x421177
pop edi
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4211a8
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, esi
and edi, 0xf
jbe 0x4211a4
cmp esi, eax
jae 0x4211a8
sub edi, 1
movzx ecx, word [esi]
lea esi, [esi + ecx*2 + 2]
jne 0x421194
cmp esi, eax
jb 0x4211ae
pop esi
pop edi
xor eax, eax
pop ebp
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebp
ret
Function at 0x4225d0
Capabilities:
Parse url

Disassembly:
sub esp, 0x3c
push ebx
push esi
push edi
xor ebx, ebx
push 0x38
mov edi, eax
lea eax, [esp + 0x14]
push ebx
push eax
mov dword [esp + 0x18], ebx
call sub.MSVCR80.dll_memset
mov eax, dword [edi + 0x14]
add eax, 1
push eax
call fcn.00424aa5
mov esi, eax
add esp, 0x10
cmp esi, ebx
je 0x422686
mov ecx, dword [edi + 0x14]
add ecx, 1
push ecx
push ebx
push esi
call sub.MSVCR80.dll_memset
mov eax, dword [edi + 0x14]
add esp, 0xc
cmp dword [edi + 0x18], 0x10
lea edx, [eax + 1]
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], edx
jb 0x422636
mov edi, dword [edi + 4]
jmp 0x422639
add edi, 4
lea ecx, [esp + 0xc]
push ecx
push 0x10000000
push eax
push edi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
je 0x42267d
mov eax, dword [esp + 0x18]
cmp eax, 3
je 0x42265d
cmp eax, 4
jne 0x42267d
mov edx, dword [esp + 0x50]
push esi
mov dword [edx], eax
call dword [sym.imp.MSVCR80.dll__strlwr]
mov ecx, dword [esp + 0x50]
add esp, 4
push esi
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__]
mov ebx, 1
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x3c
ret

Function at 0x422eb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x42ed68
push 0x425171
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x434020]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x30]
cmp word [ecx], 0x5a4d
jne 0x422f4f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x422f4f
mov edx, dword [eax + 0xd8]
lea edi, [edx + ecx]
cmp esi, edi
jb 0x422f4f
mov eax, dword [eax + 0xdc]
add eax, edx
add eax, ecx
cmp esi, eax
jae 0x422f4f
mov dword [ebp - 4], 0xfffffffe
mov al, 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x422ff0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ecx
push esi
mov esi, dword [0x4365b8]
test esi, esi
je 0x42301a
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x423003
pop edi
pop esi
pop ecx
ret
Function at 0x423400
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4365c4], eax
je 0x423416
mov eax, 0x10dd
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [0x4365d4]
xor ebp, ebp
cmp esi, ebp
push edi
je 0x423491
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [esp]
mov edx, dword [esi + 0x10]
mov ecx, dword [esi + 0x14]
lea eax, [esp + 0x10]
push eax
movzx eax, byte [edx + 0x17]
push ecx
mov ecx, dword [esi + 0xc]
push eax
push ecx
call ebx
cmp dword [esi + 4], ebp
jne 0x423480
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x423480
mov edx, eax
and edx, 0xffff0000
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov ecx, dword [edx + 8]
mov dword [eax + 0x18], ecx
mov dword [edx + 8], eax
mov dword [esi + 0x10], ebp
mov edi, dword [esi]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x423430
mov dword [0x4365d4], ebp
call fcn.00423020
mov esi, dword [0x4365d0]
cmp esi, ebp
je 0x4234c7
mov ebx, dword [sym.imp.KERNEL32.dll_ResumeThread]
lea esp, [esp]
mov edx, dword [esi + 4]
push edx
call ebx
mov edi, dword [esi]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp edi, ebp
mov esi, edi
jne 0x4234b0
pop edi
pop esi
mov dword [0x4365d0], ebp
mov dword [0x4365c4], ebp
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x4237b0
Capabilities:
Suspend thread

Disassembly:
push edi
mov edi, eax
mov eax, dword [0x4365c8]
test eax, eax
jne 0x423825
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp edi, eax
jne 0x4237ca
xor eax, eax
pop edi
ret
push esi
push 8
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 4
test esi, esi
jne 0x4237e0
lea edi, [eax + 8]
jmp 0x4237fd
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x423812
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
mov dword [0x4365c8], edi
mov eax, edi
mov dword [0x4365cc], 0
pop edi
ret
mov eax, dword [0x4365d0]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x4365d0], esi
xor eax, eax
pop esi
pop edi
ret
Function at 0x423830
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub esp, 0x10
push ebx
push edi
xor edi, edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4365c4], eax
je 0x423854
pop edi
mov eax, 0x10dd
pop ebx
add esp, 0x10
ret 8
mov eax, dword [0x4365c8]
cmp eax, edi
jne 0x423a5e
mov eax, dword [esp + 0x1c]
cmp eax, edi
jne 0x423876
pop edi
mov eax, 6
pop ebx
add esp, 0x10
ret 8
push esi
mov esi, dword [eax]
cmp esi, edi
jne 0x42389a
pop esi
pop edi
mov dword [0x4365cc], eax
mov dword [0x4365c8], 6
mov eax, 6
pop ebx
add esp, 0x10
ret 8
push ebp
mov dword [esp + 0x10], edi
call fcn.00423360
mov esi, dword [esp + 0x28]
mov ebp, eax
call fcn.00423360
cmp eax, ebp
mov dword [esp + 0x28], eax
jne 0x4238c8
cmp dword [0x4365c0], ebx
jne 0x423a00
jmp 0x4239de
push 0x18
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
mov dword [esp + 0x10], eax
jne 0x4238e2
lea ebx, [eax + 8]
jmp 0x4239de
mov eax, ebp
call fcn.00423050
mov edi, eax
test edi, edi
jne 0x4238f7
lea ebx, [eax + 8]
jmp 0x4239de
mov esi, ebp
xor ebx, ebx
jmp 0x423900
lea eax, [ebx + edi]
push eax
lea edx, [esp + 0x18]
mov ecx, esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], 0
call fcn.00423a70
cmp dword [esp + 0x14], 0
mov esi, eax
jne 0x423949
mov ecx, dword [esp + 0x1c]
mov ebx, esi
sub ebx, ebp
call fcn.00422fa0
test eax, eax
jne 0x423949
cmp ebx, 5
jl 0x423900
cmp ebx, 0x12
jbe 0x423962
mov ebx, 6
jmp 0x4239de
cmp ebx, 5
jge 0x42393a
cmp dword [0x4365c0], 0
mov ebx, 9
jne 0x4239e4
jmp 0x4239de
mov ecx, dword [esp + 0x28]
mov dword [edi + 0x1c], ecx
lea ecx, [ebx + edi]
lea edx, [ebx + ebp]
mov dword [edi + 0x18], edx
lea eax, [edi + 0x17]
lea esi, [ecx + 5]
mov byte [eax], bl
mov byte [ecx], 0xe9
add ecx, 1
sub edx, esi
mov dword [ecx], edx
add ecx, 4
call fcn.00422f70
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [esp + 0x18]
push edx
push 0x40
push ebx
push ebp
mov dword [esp + 0x28], 0
call esi
test eax, eax
je 0x4239d6
mov ecx, ebp
call fcn.004232b0
mov ebx, eax
test ebx, ebx
je 0x423a2e
cmp word [ebx + 0x1c], 0x6544
je 0x423a2e
lea eax, [esp + 0x28]
push eax
push 0x40
push 0x40
push ebx
mov dword [esp + 0x38], 0
call esi
test eax, eax
jne 0x423a16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x4365c8], ebx
test edi, edi
je 0x4239ef
mov eax, edi
call fcn.00423280
mov eax, dword [esp + 0x10]
test eax, eax
je 0x423a00
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x24]
pop ebp
pop esi
pop edi
mov eax, ebx
mov dword [0x4365cc], ecx
pop ebx
add esp, 0x10
ret 8
mov word [ebx + 0x1c], 0x6544
mov word [ebx + 0x1e], 0x6f74
mov word [ebx + 0x20], 0x7275
mov word [ebx + 0x22], 0x2173
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
mov dword [eax + 8], edx
mov edx, dword [0x4365d4]
mov dword [eax + 0xc], ebp
mov dword [eax + 4], 0
mov dword [eax + 0x10], edi
mov ecx, dword [esp + 0x18]
pop ebp
mov dword [eax + 0x14], ecx
mov dword [eax], edx
mov dword [0x4365d4], eax
xor eax, eax
pop esi
pop edi
pop ebx
add esp, 0x10
ret 8
Function at 0x424020
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0xc
push esi
push edi
xor edi, edi
cmp dword [0x43667c], edi
jne 0x4241e6
mov eax, dword [0x436678]
cmp eax, edi
jne 0x4241e8
xor eax, eax
mov dword [0x436680], eax
mov dword [0x436684], eax
mov dword [0x436688], eax
mov dword [0x43668c], eax
mov dword [0x436690], eax
mov dword [0x436694], eax
mov dword [0x436698], eax
mov dword [0x43669c], eax
mov dword [0x4366a0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push str.dbghelp.dll
mov dword [0x436680], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [0x436684], eax
je 0x4241a7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ImagehlpApiVersionEx
push eax
call esi
mov dword [0x436688], eax
mov eax, dword [0x436684]
push str.SymInitialize
push eax
call esi
mov ecx, dword [0x436684]
push str.SymSetOptions
push ecx
mov dword [0x43668c], eax
call esi
mov edx, dword [0x436684]
push str.SymGetOptions
push edx
mov dword [0x436690], eax
call esi
mov dword [0x436694], eax
mov eax, dword [0x436684]
push str.SymLoadModule64
push eax
call esi
mov ecx, dword [0x436684]
push str.SymGetModuleInfo64
push ecx
mov dword [0x436698], eax
call esi
mov edx, dword [0x436684]
push str.SymFromName
push edx
mov dword [0x43669c], eax
call esi
xor ecx, ecx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [0x436688]
cmp ecx, edi
mov esi, 0xb
mov dword [0x4366a0], eax
mov word [esp + 8], si
je 0x4241a2
cmp dword [0x43668c], edi
je 0x4241a2
cmp dword [0x436698], edi
je 0x4241a2
cmp dword [0x43669c], edi
je 0x4241a2
cmp eax, edi
je 0x4241a2
lea eax, [esp + 8]
push eax
call ecx
cmp word [esp + 8], si
jb 0x4241a2
mov ecx, dword [0x436680]
push edi
push edi
push ecx
call dword [0x43668c]
test eax, eax
je 0x4241a2
mov eax, dword [0x436694]
cmp eax, edi
je 0x424192
cmp dword [0x436690], edi
je 0x424192
call eax
and eax, 0xfffffffc
or eax, 0x2704
push eax
call dword [0x436690]
mov eax, 0x436680
mov dword [0x436678], eax
pop edi
pop esi
add esp, 0xc
ret
mov eax, dword [0x436684]
cmp eax, edi
mov dword [0x43667c], 1
je 0x4241bc
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x436688], edi
mov dword [0x43668c], edi
mov dword [0x436690], edi
mov dword [0x436694], edi
mov dword [0x436698], edi
mov dword [0x43669c], edi
mov dword [0x4366a0], edi
xor eax, eax
pop edi
pop esi
add esp, 0xc
ret
Function at 0x4244fd
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x436018], 0
push esi
jne 0x424470
call fcn.0042439b
test eax, eax
je 0x4244b3
mov eax, dword [0x436018]
cmp eax, 1
jne 0x424491
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4244b3
pop esi
ret
push eax
call dword [0x436020]
test eax, eax
jne 0x4244fb
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4244b7
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x436018]
call dword [0x436020]
mov edi, eax
test edi, edi
je 0x4244de
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4244fa
lea edi, [esi + 0xff0]
push esi
push dword [0x436018]
call dword [0x43601c]
add esi, 0x10
cmp esi, edi
jb 0x4244e4
mov eax, esi
pop edi
pop esi
ret
jmp 0x42445d

Function at 0x424771
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x434020]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.004246b0
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4247c0
cmp dword [ebp - 0x1c], 5
jb 0x4247d8
jmp 0x4247d4
cmp dword [ebp - 0x10], 1
jne 0x4247d8
cmp dword [ebp - 0x1c], 4
ja 0x4247d4
jne 0x4247d8
cmp dword [ebp - 0x18], 0
jbe 0x4247d8
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4287e4
call fcn.00402be0
test eax, eax
jge 0x4247f9
mov byte [0x436444], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00424bfa
add ebp, 0x78
leave
ret

Function at 0x424bfa
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434020]
jne 0x424c04
repz ret
jmp fcn.00425194
Function at 0x406670
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push 0xff0000
push 0
push 0
push 0x3e8
push 0x44c
push 0x411670
push 0x4048a0
lea eax, [ebp - 4]
push eax
call fcn.00406410
add esp, 0x20
movzx ecx, al
test ecx, ecx
jne 0x4066aa
xor eax, eax
jmp 0x406707
push 0xa
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x1c
push 0
lea ecx, [ebp - 0x20]
push ecx
call fcn.00406d60
add esp, 0xc
cmp dword [ebp - 0x1c], 0x12
je 0x406705
push 0
push 0
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x406703
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4066d0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x406e09
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x411700
call fcn.0040718c
mov edi, 0x94
mov eax, edi
call fcn.0040af60
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x44fdb4], ecx
mov eax, dword [esi + 4]
mov dword [0x44fdc0], eax
mov edx, dword [esi + 8]
mov dword [0x44fdc4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x44fdb8], esi
cmp ecx, 2
je 0x406e69
or esi, 0x8000
mov dword [0x44fdb8], esi
shl eax, 8
add eax, edx
mov dword [0x44fdbc], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x406ea4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406ea4
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x406ebc
cmp eax, 0x20b
je 0x406ea9
mov dword [ebp - 0x1c], esi
jmp 0x406ed0
cmp dword [ecx + 0x84], 0xe
jbe 0x406ea4
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x406eca
cmp dword [ecx + 0x74], 0xe
jbe 0x406ea4
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.0040af07
pop ecx
test eax, eax
jne 0x406ee4
push 0x1c
call fcn.00406de5
pop ecx
call fcn.004091cd
test eax, eax
jne 0x406ef5
push 0x10
call fcn.00406de5
pop ecx
call fcn.0040ae65
mov dword [ebp - 4], esi
call fcn.0040ac67
test eax, eax
jge 0x406f0e
push 0x1b
call fcn.00406dc0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4515e4], eax
call fcn.0040ab45
mov dword [0x44fd84], eax
call fcn.0040aaa3
test eax, eax
jge 0x406f34
push 8
call fcn.00406dc0
pop ecx
call fcn.0040a870
test eax, eax
jge 0x406f45
push 9
call fcn.00406dc0
pop ecx
push 1
call fcn.0040a392
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x406f5b
push eax
call fcn.00406dc0
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0040a813
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x406f7c
movzx eax, word [ebp - 0x40]
jmp 0x406f7f
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.00406670
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x406f9d
push edi
call fcn.0040a4bf
call fcn.0040a4e1
jmp 0x406fcf
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004071c7
ret
Function at 0x40939d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x409571
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x4504c0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x409571
test cl, 0x48
je 0x409408
cmp byte [eax + 5], 0xa
je 0x409408
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40945a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x409442
call fcn.0040996d
mov dword [eax], 9
call fcn.00409976
mov dword [eax], esi
jmp 0x409452
cmp eax, 0x6d
je 0x409571
push eax
call fcn.0040997f
pop ecx
or eax, 0xffffffff
jmp 0x409573
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x40956c
test eax, eax
je 0x409481
cmp byte [ebx], 0xa
jne 0x409481
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x40948a
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x409566
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x409556
cmp al, 0xd
je 0x4094bc
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x409548
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x4094d6
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x4094d1
add dword [ebp + 0x10], 2
jmp 0x40952a
mov dword [ebp + 0x10], eax
jmp 0x409544
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4094fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x409544
cmp dword [ebp - 0xc], 0
je 0x409544
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x40951f
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x40952a
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x409547
cmp ebx, dword [ebp + 0xc]
jne 0x40952f
cmp byte [ebp - 1], 0xa
jne 0x40952f
mov byte [ebx], 0xa
jmp 0x409547
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040b5db
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x409548
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x4094a0
jmp 0x409566
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x409566
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x409573
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret