joyce8/EMBER2024-capa huggingface dataset:
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x118ac058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.118ac1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x118ac07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x118ac06a
add dl, dl
jne 0x118ac089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x118ac0dc
xor eax, eax
add dl, dl
jne 0x118ac096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x118ac17d
add dl, dl
jne 0x118ac0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x118ac0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x118ac0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x118ac0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x118ac0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x118ac075
mov eax, 1
add dl, dl
jne 0x118ac0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x118ac0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x118ac0e1
sub eax, ebx
mov ebx, 1
jne 0x118ac128
mov ecx, 1
add dl, dl
jne 0x118ac10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x118ac119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x118ac105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x118ac075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x118ac13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x118ac14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x118ac136
cmp eax, 0x7d00
jae 0x118ac16d
cmp eax, 0x500
jb 0x118ac168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x118ac075
cmp eax, 0x7f
ja 0x118ac170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x118ac075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x118ac19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x118ac075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4012da
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x402e40
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402e59
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x402e6d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402e8e
cmp esi, eax
jae 0x402e67
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402e80
cmp esi, eax
jae 0x402e67
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40137a
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
jmp 0x404ef0
push ecx
mov eax, dword [ecx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x404fe4
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ebx, dword [esp + 0x1c]
xor eax, eax
xor ecx, ecx
test ebx, ebx
jle 0x404f33
lea esp, [esp]
mov edx, dword [esp + 0x18]
mov edx, dword [edx + eax*4]
mov edx, dword [edx - 0xc]
inc eax
cmp eax, ebx
lea ecx, [ecx + edx + 2]
jl 0x404f20
push ecx
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov esi, ebp
mov cl, byte [edx]
inc edx
mov byte [esi], cl
inc esi
test cl, cl
jne 0x404f56
mov eax, 1
cmp ebx, eax
jle 0x404fca
lea esp, [esp]
mov edi, ebp
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404f73
mov cx, word [0x48c734]
mov word [edi], cx
mov dl, byte [0x48c736]
mov ecx, dword [esp + 0x18]
mov byte [edi + 2], dl
mov ecx, dword [ecx + eax*4]
mov edx, ecx
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x404f97
sub ecx, edx
mov edi, ebp
mov esi, edx
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404fa7
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c]
inc eax
cmp eax, ecx
jl 0x404f70
mov edi, dword [esp + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x401442
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x406eb0
push 0xffffffffffffffff
push 0x486180
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.0044d86c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x30]
xor eax, eax
xor ebx, ebx
cmp ecx, eax
mov dword [esp + 0x20], eax
je 0x406f08
mov edi, dword [esp + 0x28]
mov ecx, dword [edi + 8]
mov esi, dword [esp + 0x2c]
mov word [edi + 4], ax
mov dword [ecx + 4], eax
jmp 0x40701d
mov edx, dword [esp + 0x2c]
push edx
lea eax, [esp + 0x18]
push eax
mov ecx, ebp
call fcn.004411f7
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 1
call fcn.004016db
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x20], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406f4b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edi, dword [esp + 0x28]
mov eax, dword [edi + 8]
test eax, eax
je 0x407003
inc word [edi + 4]
movzx esi, word [edi + 4]
mov ebx, dword [esp + 0x10]
shl esi, 4
add esi, eax
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406f70
mov ecx, dword [esp + 0x2c]
sub eax, edx
movzx edx, ax
inc edx
push edx
mov word [esi + 2], ax
mov dword [esi + 4], ecx
call fcn.0044cf6f
add esp, 4
test eax, eax
mov dword [esi + 0xc], eax
jne 0x406fd1
lea eax, [ebx - 0x10]
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x406fba
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
mov ecx, ebx
sub eax, ebx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
inc ecx
test dl, dl
jne 0x406fd5
mov eax, dword [esp + 0x2c]
push 8
push eax
mov ecx, ebp
call fcn.0043fed4
mov dword [esi + 8], eax
mov bx, word [edi + 4]
mov edx, dword [edi + 8]
movzx ecx, bx
shl ecx, 4
mov word [ecx + edx], 0
mov eax, dword [esp + 0x2c]
mov ecx, dword [ebp + 0x1c]
push eax
push 4
push 0x110a
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
xor eax, eax
cmp esi, eax
je 0x40705b
movzx ebx, bx
shl ebx, 4
mov edx, dword [edi + 8]
inc word [ebx + edx]
push 0
push esi
lea eax, [ebx + edx]
push edi
mov ecx, ebp
call fcn.00401442
cmp dword [esp + 0x30], 2
je 0x40705b
mov eax, dword [ebp + 0x1c]
push esi
push 1
push 0x110a
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
test esi, esi
jne 0x407027
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x20], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x407081
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret 0xc
Function at 0x401659
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
jmp 0x409040
mov eax, dword [ecx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x409093
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x409068
xor ecx, ecx
jmp 0x40907a
mov ecx, eax
push esi
lea esi, [ecx + 1]
mov edi, edi
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x409070
sub ecx, esi
pop esi
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00401037
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
ret 4
Function at 0x4018de
Capabilities:
Set current directory

Disassembly:
jmp 0x40b1f0
push 0xffffffffffffffff
push 0x4864a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [esp], ecx
lea ecx, [esp + 4]
call fcn.004116ba
test byte [0x4ae3d0], 1
mov dword [esp + 0x24], 0
jne 0x40b24d
or dword [0x4ae3d0], 1
call fcn.0044d86c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
push 0x48ae70
mov dword [0x4ae3cc], eax
call fcn.00420456
add esp, 4
mov eax, dword [esp + 0x2c]
push 0
push eax
lea ecx, [esp + 0xc]
call fcn.0041174d
test eax, eax
je 0x40b384
push ebx
mov ebx, dword [esp + 0x34]
push ebp
push esi
push edi
lea ecx, [ecx]
lea ecx, [esp + 0x14]
call fcn.00411468
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x44], eax
call fcn.004118d6
mov ecx, dword [eax]
mov esi, dword [0x4ae3cc]
lea eax, [ecx - 0x10]
add esi, 0xfffffff0
cmp eax, esi
mov byte [esp + 0x34], 1
je 0x40b2eb
mov edx, dword [esi + 0xc]
test edx, edx
lea edi, [esi + 0xc]
jl 0x40b2dc
mov edx, dword [eax]
cmp edx, dword [esi]
jne 0x40b2dc
push eax
call fcn.004012a8
mov ebp, eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [edi], eax
dec eax
test eax, eax
jg 0x40b2d1
mov ecx, dword [esi]
mov edx, dword [ecx]
push esi
call dword [edx + 4]
add ebp, 0x10
mov dword [0x4ae3cc], ebp
jmp 0x40b2eb
mov eax, dword [ecx - 0xc]
push eax
push ecx
mov ecx, 0x4ae3cc
call fcn.00401037
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov byte [esp + 0x34], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40b30e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
push 0x10
lea ecx, [esp + 0x18]
call dword [eax + 0x38]
test eax, eax
je 0x40b374
lea ecx, [esp + 0x14]
call fcn.00411681
test eax, eax
jne 0x40b374
mov edx, dword [esp + 0x14]
push 2
lea ecx, [esp + 0x18]
call dword [edx + 0x38]
test eax, eax
jne 0x40b374
push 0x4ae3cc
mov ecx, ebx
call fcn.004013e3
mov eax, dword [0x4ae3cc]
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push eax
call esi
mov ecx, dword [esp + 0x10]
push 0
push ebx
push 0
call fcn.004018de
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x40b374
push 0x48cbec
call esi
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x40b270
pop edi
pop esi
pop ebp
pop ebx
lea ecx, [esp + 4]
mov dword [esp + 0x24], 0xffffffff
call fcn.004116de
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 0xc
Function at 0x40df66
Capabilities:
Get common file path

Disassembly:
jmp 0x40df50
push 0xffffffffffffffff
push 0x486618
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.00458283
lea ecx, [esi + 0x50]
mov dword [esp + 0x14], 0
mov dword [esi], 0x48d498
call fcn.004012b2
call fcn.0044d86c
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea edi, [esi + 0x62]
push edi
add eax, 0x10
push 0x104
mov dword [esi + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec edi
jmp 0x40dfb0
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40dfb0
mov eax, dword [str.Examples]
mov dword [edi], eax
mov ecx, dword [0x48d48c]
mov dword [edi + 4], ecx
mov dx, word [0x48d490]
mov ecx, dword [esp + 0xc]
mov word [edi + 8], dx
mov word [esi + 0x60], 0x2c
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x411f7b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
je 0x411fce
call fcn.00470da2
mov edi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x411fce
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x411fc4
xor eax, eax
jmp 0x4120e7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
je 0x411ffe
mov eax, dword [esi]
push edi
push dword [ebp - 4]
mov ecx, esi
push ebx
call dword [eax + 0x1c]
cmp dword [ebp - 8], 0
mov dword [ebp - 0xc], eax
je 0x411ffe
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebx + 0x48]
test eax, eax
je 0x4120e4
mov ecx, dword [eax + 0x40]
and dword [ebp + 0xc], 0
test ecx, ecx
mov dword [ebp + 8], ecx
mov dword [ebp - 8], ecx
je 0x41202b
lea ecx, [eax + 0x3c]
lea eax, [ebp + 8]
push eax
call fcn.0040f1e0
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
xor eax, eax
cmp dword [edi + 8], eax
mov dword [ebp - 4], eax
jbe 0x4120e4
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x412074
mov ecx, dword [ecx + 4]
mov edx, dword [edi + 0xc]
mov ecx, dword [ecx + 0x28]
cmp ecx, dword [edx + eax*8]
jne 0x412074
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 8], eax
je 0x41206e
mov ecx, dword [ebx + 0x48]
lea eax, [ebp + 8]
add ecx, 0x3c
push eax
call fcn.0040f1e0
mov eax, dword [eax]
mov dword [ebp + 0xc], eax
jmp 0x4120d4
and dword [ebp + 0xc], 0
jmp 0x4120d4
mov ecx, dword [edi + 0xc]
shl eax, 3
cmp dword [eax + ecx], 0
mov dword [ebp - 0x10], eax
je 0x4120d4
push 0xc
call fcn.0044cf3f
mov esi, eax
test esi, esi
pop ecx
je 0x4120b6
mov eax, dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x1c]
add eax, edx
push dword [eax]
mov edi, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
and dword [esi + 4], 0
mov dword [esi + 8], edi
mov edi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x4120b8
xor esi, esi
mov ecx, dword [ebx + 0x48]
add ecx, 0x3c
cmp dword [ebp - 8], 0
push esi
je 0x4120cf
push dword [ebp - 8]
call fcn.004444b3
jmp 0x4120d4
call fcn.00444410
mov eax, dword [ebp - 4]
inc eax
cmp eax, dword [edi + 8]
mov dword [ebp - 4], eax
jb 0x412039
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x42070e
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00420900
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4207a9
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x4b0594]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x4207a9
cmp eax, 1
je 0x4207ca
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4207a9
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x420776
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x4207a5
xor eax, eax
inc eax
jmp 0x4207e9
cmp edi, eax
jae 0x4207ad
xor eax, eax
jmp 0x4207e9
cmp eax, esi
jae 0x4207b4
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x4b0594]
jmp 0x4207cd
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x420c89
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x495770
call fcn.004221b4
mov edi, 0x94
mov eax, edi
call fcn.00420900
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4b0594], ecx
mov eax, dword [esi + 4]
mov dword [0x4b05a0], eax
mov edx, dword [esi + 8]
mov dword [0x4b05a4], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4b0598], esi
cmp ecx, 2
je 0x420ce9
or esi, 0x8000
mov dword [0x4b0598], esi
shl eax, 8
add eax, edx
mov dword [0x4b059c], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x420d24
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x420d24
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x420d3c
cmp eax, 0x20b
je 0x420d29
mov dword [ebp - 0x1c], esi
jmp 0x420d50
cmp dword [ecx + 0x84], 0xe
jbe 0x420d24
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x420d4a
cmp dword [ecx + 0x74], 0xe
jbe 0x420d24
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.00426bd0
pop ecx
test eax, eax
jne 0x420d64
push 0x1c
call fcn.00420c0f
pop ecx
call fcn.00423fa4
test eax, eax
jne 0x420d75
push 0x10
call fcn.00420c0f
pop ecx
call fcn.00428bbe
mov dword [ebp - 4], esi
call fcn.00428974
test eax, eax
jge 0x420d8e
push 0x1b
call fcn.00420bea
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x4b22c0], eax
call fcn.00428852
mov dword [0x4b0580], eax
call fcn.004287b0
test eax, eax
jge 0x420db4
push 8
call fcn.00420bea
pop ecx
call fcn.0042857d
test eax, eax
jge 0x420dc5
push 9
call fcn.00420bea
pop ecx
push 1
call fcn.00421b97
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x420ddb
push eax
call fcn.00420bea
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.00428520
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x420dfc
movzx eax, word [ebp - 0x40]
jmp 0x420dff
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0043326d
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x420e1d
push edi
call fcn.00421cc4
call fcn.00421ce6
jmp 0x420e4f
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004221ef
ret
Function at 0x421c01
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4957b8
call fcn.004221b4
push 8
call fcn.004242c7
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x4b05d4], esi
jne 0x421c35
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x4b05d0], esi
mov al, byte [ebp + 0x10]
mov byte [0x4b05cc], al
cmp dword [ebp + 0xc], edi
jne 0x421c7f
cmp dword [0x4b22b8], edi
je 0x421c6f
mov eax, dword [0x4b22b4]
sub eax, 4
mov dword [0x4b22b4], eax
cmp eax, dword [0x4b22b8]
jb 0x421c6f
mov eax, dword [eax]
cmp eax, edi
je 0x421c50
call eax
jmp 0x421c50
push 0x4aacbc
mov eax, 0x4aaab4
call fcn.00421b61
pop ecx
push 0x4aafc8
mov eax, 0x4aadc0
call fcn.00421b61
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x421cb0
cmp dword [ebp + 0x10], edi
jne 0x421cbe
mov dword [0x4b05d4], esi
push dword [ebp + 8]
call fcn.00421b1f
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x421cbd
push 8
call fcn.004241fa
pop ecx
ret
call fcn.004221ef
ret

Function at 0x421df5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x421e12
call fcn.0041ff74
mov dword [eax], 0x16
xor eax, eax
jmp 0x421e7c
push esi
push 0x8c
push 1
call fcn.00422200
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x421e67
push esi
call fcn.00423d9e
mov eax, dword [ebp + 0x14]
or dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
pop ecx
mov dword [esi + 0x4c], edi
jne 0x421e45
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push esi
push 0x421d60
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x421e7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push esi
call fcn.0042069d
test ebx, ebx
pop ecx
je 0x421e79
push ebx
call fcn.0041ff86
pop ecx
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x425300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x4254d4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x4b0b40]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x4254d4
test cl, 0x48
je 0x42536b
cmp byte [eax + 5], 0xa
je 0x42536b
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4253bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x4253a5
call fcn.0041ff74
mov dword [eax], 9
call fcn.0041ff7d
mov dword [eax], esi
jmp 0x4253b5
cmp eax, 0x6d
je 0x4254d4
push eax
call fcn.0041ff86
pop ecx
or eax, 0xffffffff
jmp 0x4254d6
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x4254cf
test eax, eax
je 0x4253e4
cmp byte [ebx], 0xa
jne 0x4253e4
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x4253ed
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x4254c9
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x4254b9
cmp al, 0xd
je 0x42541f
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x4254ab
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x425439
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x425434
add dword [ebp + 0x10], 2
jmp 0x42548d
mov dword [ebp + 0x10], eax
jmp 0x4254a7
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x425461
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4254a7
cmp dword [ebp - 0xc], 0
je 0x4254a7
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x425482
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x42548d
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x4254aa
cmp ebx, dword [ebp + 0xc]
jne 0x425492
cmp byte [ebp - 1], 0xa
jne 0x425492
mov byte [ebx], 0xa
jmp 0x4254aa
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0042bbbc
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x4254ab
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x425403
jmp 0x4254c9
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4254c9
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x4254d6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret