joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x26d325c4
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2f405220
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x64fad0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x650898
push 0x64fac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
cld
add bh, bh
adc eax, sym.imp.MSVCRT.dll___set_app_type
pop ecx
or dword [0xa55204], 0xffffffff
or dword [0xa55208], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0xa55200]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0xa551fc]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0xa5520c], eax
call fcn.0064fc4f
cmp dword [0x6544a0], ebx
jne 0x64fb53
push 0x64fc4c
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0064fc3a
push 0x65400c
push 0x654008
call sub.MSVCRT.dll__initterm
mov eax, dword [0xa551f8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0xa551f4]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x654004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x64fbe6
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64fbba
cmp al, 0x22
jne 0x64fbac
cmp byte [esi], 0x22
jne 0x64fbc3
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x64fbcd
cmp al, 0x20
jbe 0x64fbbf
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x64fbf1
movzx eax, word [ebp - 0x2c]
jmp 0x64fbf4
cmp byte [esi], 0x20
jbe 0x64fbc3
inc esi
mov dword [ebp - 0x74], esi
jmp 0x64fbe6
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
mov edi, dword [ebp + 8]
push 0x64
push 0x4844d0
push 0x67
push edi
call esi
push 0x64
push 0x484408
push 0x6d
push edi
call esi
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0x6b
push edi
mov dword [ebp - 0x34], 0x30
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 0x401180
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], edi
call esi
push 0x7f00
push 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
push 0x6c
push dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x10], 0x6d
mov dword [ebp - 0xc], 0x484408
call esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push edi
push 0
push 0
push 0x14a
push 0x22e
push 0xc8
push 0x12c
push 0xcf0000
push 0x4844d0
push 0x484408
push 0
mov dword [0x484400], edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x4010f0
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401469
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp + 0x14]
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0x6d
push edi
call dword [sym.imp.USER32.dll_LoadAcceleratorsW]
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
push 0
push 0
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x50]
push 0
push eax
call esi
test eax, eax
je 0x401161
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
push ebx
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageW]
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x50]
call dword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x401150
lea eax, [ebp - 0x50]
push eax
call edi
lea eax, [ebp - 0x50]
push eax
call ebx
push 0
push 0
push 0
lea eax, [ebp - 0x50]
push eax
call esi
test eax, eax
jne 0x401130
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
xor ecx, ebp
pop edi
pop esi
call fcn.00401469
mov esp, ebp
pop ebp
ret 0x10

Function at 0x401c9f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401cde
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401cde
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401cde
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401cde
cmp dword [ecx + 0x74], 0xe
jbe 0x401cde
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x40762f
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x40767a
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.004077ca
test al, al
jne 0x407674
sub edx, 2
cmp edx, edi
jne 0x40765a
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x40769c
lea eax, [edi + 2]
cmp edx, eax
je 0x40769c
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0040757b
add esp, 0x10
jmp 0x407796
push esi
lea ecx, [ebp - 0x255]
call fcn.004077ca
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4076df
push dword [ebp - 0x25c]
jmp 0x40768c
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x40771c
cmp word [ebp - 0x226], 0
je 0x40773d
cmp word [ebp - 0x226], ax
jne 0x40771c
cmp word [ebp - 0x224], 0
je 0x40773d
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0040757b
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x407789
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4076f6
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x407771
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x407796
push 0x4073ab
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040af70
add esp, 0x10
jmp 0x407766
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401469
leave
ret
Function at 0x4082eb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408388
push ebx
push esi
call fcn.004082b4
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00408248
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408335
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408387
push edi
push eax
call fcn.00408f56
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x408355
call fcn.00405e0b
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408386
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00408248
add esp, 0x20
test eax, eax
jne 0x408374
push edi
call fcn.00405e0b
jmp 0x40837c
push ebx
call fcn.00405e0b
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x409721
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x412098
push 0x412090
push str.FlsAlloc
push 0x1f
call fcn.004095e0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409755
push dword [ebp + 8]
mov ecx, esi
call dword [0x41019c]
call esi
jmp 0x40975b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x40979f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4120a8
push 0x4120a0
push str.FlsGetValue
push 0x21
call fcn.004095e0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4097d6
push dword [ebp + 8]
mov ecx, esi
call dword [0x41019c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4097de
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4120b0
push 0x4120a8
push str.FlsSetValue
push 0x22
call fcn.004095e0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409818
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x41019c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40f140
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40f16d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40f16d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405a83
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x405aa9
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x405aa9
xor al, al
jmp 0x405ac9
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00414490
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x40cdf0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x41a510
call fcn.00413954
push ecx
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], 8
mov dword [esi], 0x41b694
mov dword [ebp - 4], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dword [esi + 0x24], 1
mov dword [esi + 0x14], 0x41b748
push 4
mov ebx, 0x41b684
pop eax
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], eax
mov dword [esi + 0x28], ebx
lea ecx, [esi + 0x3c]
push eax
mov byte [ebp - 4], 2
call fcn.004032a8
mov dword [esi + 0x3c], 0x41b7f8
push 4
mov dword [esi + 0x54], edi
pop eax
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x60], eax
mov dword [esi + 0x50], ebx
lea edi, [esi + 0x64]
push eax
mov ecx, edi
mov byte [ebp - 4], al
call fcn.004032a8
mov dword [edi], 0x41b800
lea edi, [esi + 0x78]
mov byte [ebp - 4], 5
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b99b
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 6
call fcn.0040c3f8
lea edi, [esi + 0xa0]
mov byte [ebp - 4], 7
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b99b
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 8
call fcn.0040c3f8
lea edi, [esi + 0xc8]
mov byte [ebp - 4], 9
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b99b
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xa
call fcn.0040c3f8
mov byte [ebp - 4], 0xb
lea edi, [esi + 0xf0]
mov ecx, edi
mov dword [ebp - 0x14], edi
call fcn.0040b99b
lea ecx, [edi + 0x14]
mov byte [ebp - 4], 0xc
call fcn.0040c3f8
lea ecx, [esi + 0x118]
mov byte [ebp - 4], 0xd
call fcn.0040c3f8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x413220
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.004148be
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x413248
xor eax, eax
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x413257
mov eax, 1
ret 4

Function at 0x4ca25d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4c9fca
sub esi, 0x5ba5888
call fcn.004ca28b
mov ebx, esi
sub esi, ebx
xor dword [edi], eax
add esi, ebx
add edi, 1
add ebx, ebx
sub ebx, ebx
cmp edi, ecx
jne fcn.004ca25d
sub esi, ebx
ret
Function at 0x401168
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff38
mov eax, dword [ebp + 0xc]
sub eax, 0x10
je 0x4011f2
sub eax, 0x100
je 0x401188
dec eax
je 0x4011ec
jmp 0x401213
push 0
push 0x51
push 6
push str.CadIS
push str._s__v__u._lu._u
lea edx, [ebp - 0xc8]
push edx
call sub.CC32100.DLL__sprintf
add esp, 0x18
lea ecx, [ebp - 0xc8]
push ecx
push 0x79
push dword [ebp + 8]
call sub.USER32.DLL_SetDlgItemTextA
cmp dword [0x40a0c8], 0
je 0x4011d3
push dword [0x40a0cc]
push 0x66
push dword [ebp + 8]
call sub.USER32.DLL_CheckDlgButton
jmp 0x4011e5
push 0
push 0x66
push dword [ebp + 8]
call sub.USER32.DLL_GetDlgItem
push eax
call sub.USER32.DLL_ShowWindow
mov eax, 1
jmp 0x401215
cmp dword [ebp + 0x10], 1
jne 0x401213
cmp dword [0x40a0c8], 0
je 0x401202
call fcn.004012a5
jmp 0x40120c
push 0
push dword [ebp + 8]
call sub.USER32.DLL_EndDialog
mov eax, 1
jmp 0x401215
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4021c0
Capabilities:
Create process on windows
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc7c
push ebx
mov ebx, 0x33
lea eax, [ebp - 0x12c]
push eax
push 0x12b
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push 0x40a63e
push str.file
lea edx, [ebp - 0x12c]
push edx
push 0
lea ecx, [ebp - 0x258]
push ecx
call sub.CC32100.DLL___makepath
add esp, 0x14
mov byte [ebp - 0x384], 0
lea eax, [ebp - 0x258]
push eax
push 0x12b
lea edx, [ebp - 0x384]
push edx
push 0x40a554
push str.ONLOAD
push str.UPDATE
call sub.KERNEL32.DLL_GetPrivateProfileStringA
cmp byte [ebp - 0x384], 0
je 0x4022a3
push 0
push 0x402179
push 0
push str.UPDATE_DLG
push dword [ebp + 8]
call sub.USER32.DLL_DialogBoxParamA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40225b
mov ebx, 0x33
test ebx, ebx
jne 0x4022a3
push 3
push 0
push 0
lea eax, [ebp - 0x384]
push eax
push 0x40a64d
push 0
call sub.SHELL32.DLL_ShellExecuteA
cmp eax, 0x20
jle 0x4022a3
mov byte [ebp - 0x12c], 0
lea edx, [ebp - 0x258]
push edx
lea ecx, [ebp - 0x12c]
push ecx
push str.ONLOAD
push str.UPDATE
call sub.KERNEL32.DLL_WritePrivateProfileStringA
xor ebx, ebx
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4027f3
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov edi, 0x35
mov eax, dword [ebp + 0xc]
shr eax, 0x10
test ax, 0xffff
jne 0x402824
mov dx, word [ebp + 0xc]
and dx, 0xffff
movzx ecx, dx
mov dword [ebp - 0x24], ecx
jmp 0x40282b
mov dword [ebp - 0x24], 0xffffffff
mov ebx, esi
push 0x40
push ebx
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x4029d2
movzx eax, word [ebx]
cmp eax, 0x5a4d
jne 0x4029d2
mov edx, dword [ebx + 0x3c]
add edx, ebx
mov dword [ebp - 4], edx
push 0xf8
push dword [ebp - 4]
call sub.KERNEL32.DLL_IsBadReadPtr
test eax, eax
jne 0x4029d2
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x4029d2
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x78]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x4029d2
add ebx, dword [ebp - 0xc]
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 0x7c]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x1c]
add ecx, esi
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x20]
add edx, esi
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0x24]
add eax, esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], 0xffffffff
je 0x4028e7
mov edx, dword [ebp - 8]
mov ebx, dword [ebp - 0x24]
sub ebx, dword [edx + 0x10]
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0x14]
cmp edi, ebx
ja 0x4028dd
mov eax, 0x12
jmp 0x4029d4
mov edx, dword [ebp - 0x18]
add esi, dword [edx + ebx*4]
mov ebx, esi
jmp 0x40292c
mov edi, dword [ebp - 8]
mov edi, dword [edi + 0x18]
test edi, edi
je 0x4029cd
mov ebx, edi
shr ebx, 1
mov eax, dword [ebp - 0x14]
mov edx, dword [eax + ebx*4]
add edx, esi
mov dword [ebp - 0x10], edx
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call sub.CC32100.DLL__strcmp
add esp, 8
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x4029a9
mov edx, dword [ebp - 0x1c]
movzx ecx, word [edx + ebx*2]
mov eax, dword [ebp - 0x18]
add esi, dword [eax + ecx*4]
mov ebx, esi
cmp ebx, dword [ebp - 8]
jb 0x40293b
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
cmp ebx, edx
jbe 0x402947
mov ecx, dword [ebp + 0x10]
mov dword [ecx], ebx
xor eax, eax
jmp 0x4029d4
push 0x2e
push ebx
call sub.CC32100.DLL__strchr
add esp, 8
mov edi, eax
test edi, edi
jne 0x40295f
mov edi, 0x1b
jmp 0x4029d2
mov eax, edi
sub eax, ebx
push eax
push ebx
lea edx, [ebp - 0x88]
push edx
call sub.CC32100.DLL__memmove
add esp, 0xc
mov ecx, edi
sub ecx, ebx
mov byte [ebp + ecx - 0x88], 0
lea eax, [ebp - 0x88]
push eax
call sub.KERNEL32.DLL_GetModuleHandleA
mov esi, eax
test esi, esi
jne 0x402999
mov edi, 0x12
jmp 0x4029d2
push dword [ebp + 0x10]
inc edi
push edi
push esi
call fcn.004027f3
add esp, 0xc
jmp 0x4029d4
cmp dword [ebp - 0x20], 0
jle 0x4029c3
inc ebx
mov eax, ebx
shl eax, 2
add dword [ebp - 0x14], eax
mov edx, ebx
add edx, edx
add dword [ebp - 0x1c], edx
sub edi, ebx
jmp 0x4029c5
mov edi, ebx
test edi, edi
jne 0x4028f5
mov edi, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40357c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push 0x8000
push dword [ebp + 8]
call sub.CC32100.DLL__open
add esp, 8
mov ebx, eax
inc eax
je 0x403613
push ebx
call sub.CC32100.DLL__filelength
pop ecx
mov dword [0x40b2f0], eax
mov edx, dword [0x40b2f0]
inc edx
push edx
call sub.CC32100.DLL__malloc
pop ecx
mov dword [0x40b2e8], eax
test eax, eax
je 0x403613
push dword [0x40b2f0]
push dword [0x40b2e8]
push ebx
call sub.CC32100.DLL__read
add esp, 0xc
cmp eax, dword [0x40b2f0]
jne 0x403613
push ebx
call sub.CC32100.DLL__close
pop ecx
push dword [0x40b2e8]
push dword [0x40b2f0]
call fcn.00402564
add esp, 8
mov edx, dword [0x40b2e8]
mov dword [0x40b2ec], edx
mov ecx, dword [0x40b2e8]
mov eax, dword [0x40b2f0]
mov byte [ecx + eax], 0
mov eax, dword [0x40b2e8]
pop ebx
pop ebp
ret
cmp ebx, 0xffffffff
je 0x40361f
push ebx
call sub.CC32100.DLL__close
pop ecx
cmp dword [0x40b2e8], 0
je 0x403634
push dword [0x40b2e8]
call sub.CC32100.DLL__free
pop ecx
xor edx, edx
mov dword [0x40b2e8], edx
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x405644
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x40566f
mov edi, 0x1b
jmp 0x4056e4
mov eax, dword [eax + 0x3c]
add eax, ebx
cmp dword [eax], 0x4550
je 0x405683
mov edi, 0x1b
jmp 0x4056e4
mov esi, eax
mov esi, dword [esi + 0x88]
add esi, ebx
mov eax, edx
shr eax, 0x10
test ax, 0xffff
je 0x4056b7
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 0x208]
push eax
push edx
call fcn.00405408
add esp, 0xc
lea edx, [ebp - 0x208]
mov dword [ebp - 8], edx
jmp 0x4056ba
mov dword [ebp - 8], edx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 1
mov cx, word [ebp + 0x10]
push ecx
push dword [ebp - 4]
push dword [ebp - 8]
push esi
push esi
call fcn.00405439
add esp, 0x20
mov edi, eax
test eax, eax
jne 0x4056e4
sub esi, ebx
mov edx, dword [ebp + 0x14]
sub dword [edx], esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407442
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff30
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [0x40aba0], 0
je 0x407580
mov edx, dword [0x40aba0]
cmp dword [edx + 0x38], 0
je 0x407580
push 0
push 0
push 0x18b
push 0x2d1
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
mov dword [ebp - 4], eax
test eax, eax
je 0x407580
xor edi, edi
cmp edi, dword [ebp - 4]
jae 0x407572
mov byte [ebp - 0xd0], 0
lea eax, [ebp - 0xd0]
push eax
push edi
push 0x189
push 0x2d1
push dword [ebp + 8]
call sub.USER32.DLL_SendDlgItemMessageA
cmp byte [ebp - 0xd0], 0
je 0x407568
push edi
push 0x2d1
push dword [ebp + 8]
call dword [0x40b1c4]
add esp, 0xc
mov esi, eax
mov ebx, dword [0x40aba0]
mov ebx, dword [ebx + 0x38]
test ebx, ebx
je 0x407568
push dword [ebx + 0x28]
lea eax, [ebp - 0xd0]
push eax
call sub.CC32100.DLL__strcmp
add esp, 8
test eax, eax
jne 0x407561
test esi, esi
je 0x407537
test byte [ebx + 0x20], 0x20
jne 0x407568
or dword [ebx + 0x20], 0x20
test byte [ebx + 0x20], 7
je 0x40752b
push 0
push 0
push ebx
call fcn.0040818c
add esp, 0xc
mov dword [ebp - 8], 1
jmp 0x407568
push 8
push dword [ebx + 4]
call sub.USER32.DLL_ShowWindow
jmp 0x407568
test byte [ebx + 0x20], 0x20
je 0x407568
push 0
push dword [ebx + 4]
call sub.USER32.DLL_ShowWindow
test byte [ebx + 0x20], 7
je 0x40755b
push ebx
call fcn.0040878c
pop ecx
mov dword [ebp - 8], 1
and dword [ebx + 0x20], 0xffffffdf
jmp 0x407568
mov ebx, dword [ebx + 0x38]
test ebx, ebx
jne 0x4074eb
inc edi
cmp edi, dword [ebp - 4]
jb 0x40749c
cmp dword [ebp - 8], 0
je 0x407580
push 1
call fcn.00401721
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret