joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024e9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x175c
call fcn.00405390
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp byte [eax], 0
je 0x40266e
mov esi, dword [ebp + 0xc]
cmp byte [esi], 0
je 0x40266e
add eax, 4
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.00404900
lea eax, [ebp - 0x30c]
push 0x5c
push eax
call fcn.00404454
add esp, 0x10
and byte [ebp - 0x104], 0
mov ebx, 0x104
lea eax, [ebp - 0x104]
push ebx
push eax
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x40266e
lea eax, [ebp - 0xd34]
push 0xa
push eax
lea eax, [ebp - 0x175c]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.0040329d
mov edi, eax
add esp, 0x14
test edi, edi
jle 0x402663
push str._nFound_open_handle
call fcn.004049f0
cmp edi, 1
pop ecx
jle 0x4025a0
push 0x40d6d4
call fcn.004049f0
pop ecx
push 0x40d6d0
call fcn.004049f0
pop ecx
mov ecx, dword [0x40e6b0]
push 0xf
call fcn.00401118
test edi, edi
jle 0x402652
xor esi, esi
mov dword [ebp + 8], edi
lea edi, [ebp + esi - 0x175c]
push edi
call fcn.00405284
pop ecx
push edi
push str._n_s_:
call fcn.004049f0
lea eax, [ebp - 0x104]
lea edi, [ebp + esi - 0xd34]
push eax
push edi
call fcn.00404a30
add esp, 0x10
cmp eax, edi
jne 0x40263a
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
call fcn.00404900
lea eax, [ebp - 0x104]
push eax
call fcn.00405120
add eax, esi
lea eax, [ebp + eax - 0xd33]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00404910
lea eax, [ebp - 0x208]
push eax
push edi
call fcn.00404900
add esp, 0x1c
push edi
push 0x40d6c4
call fcn.004049f0
pop ecx
add esi, ebx
dec dword [ebp + 8]
pop ecx
jne 0x4025c5
mov ecx, dword [0x40e6b0]
push 0
call fcn.00401118
mov al, 1
jmp 0x402670
push str._n_none_found
call fcn.004049f0
pop ecx
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403214
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x403298
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push esi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x403291
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp + 8]
je 0x403263
lea eax, [ebp - 0x128]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
jmp 0x403245
lea eax, [ebp - 0x104]
push eax
call fcn.00405120
cmp dword [ebp + 0x10], eax
pop ecx
jbe 0x403298
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call fcn.00404900
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x40329a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
leave
ret
Function at 0x40385c
Capabilities:
Check for time delay via gettickcount
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0xc], eax
mov al, byte [ebp + 0x10]
xor esi, esi
push edi
mov byte [ebp - 8], al
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x10]
push esi
push eax
push 0x40390f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0x7d0
push ebx
push eax
mov dword [ebp + 0x10], eax
call esi
mov edi, 0x102
cmp eax, edi
jne 0x4038e7
push 0x40d708
call fcn.004049f0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, 0x7530
ja 0x4038dc
push ebx
push dword [ebp + 0x10]
call esi
jmp 0x4038b5
push str._nno_response___abort
call fcn.004049f0
pop ecx
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
pop edi
pop esi
cmp eax, 0x103
pop ebx
jne 0x40390d
push 2
pop eax
leave
ret

Function at 0x403a93
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x4c]
push eax
call fcn.00404900
lea eax, [ebp - 0x4c]
push 0x5c
push eax
call fcn.00404454
add esp, 0x10
xor esi, esi
lea eax, [ebp - 0x4c]
push esi
push esi
push 3
push esi
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403afc
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp - 0xc]
push 0xc
push eax
push esi
push esi
push 0x2d1080
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x403afc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
jmp 0x403aff
or eax, 0xffffffff
pop edi
pop esi
leave
ret
Function at 0x403b03
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
push str.Floppy
push dword [ebp + 0x10]
call fcn.00404a30
cmp eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
seta cl
dec eax
push 0
dec eax
pop ebx
je 0x403b42
dec eax
je 0x403b4d
dec eax
dec eax
jne 0x403c49
mov dword [ebp + 0x10], 0x40b208
jmp 0x403b54
cmp cl, bl
mov dword [ebp + 0x10], 0x40b1f8
jne 0x403b54
mov dword [ebp + 0x10], 0x40b218
push 0x12
push ebx
push ebx
push dword [ebp + 0x10]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x403c49
mov esi, dword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInterfaces]
push 0x1c
pop eax
mov dword [ebp - 0x150], 5
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x30], eax
mov dword [ebp + 0xc], ebx
lea eax, [ebp - 0x30]
mov edi, dword [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push ebx
push edi
call esi
test eax, eax
je 0x403c42
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push ebx
push edi
call esi
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x150], 5
push eax
push ebx
lea eax, [ebp - 0x150]
push 0x104
push eax
lea eax, [ebp - 0x30]
push eax
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInterfaceDetailA]
test eax, eax
je 0x403c25
push ebx
push ebx
push 3
push ebx
push 3
lea eax, [ebp - 0x14c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x403c25
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x14]
push 0xc
push eax
push ebx
push ebx
push 0x2d1080
push edi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x403c1e
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0x10]
je 0x403c2d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp + 0xc]
jmp 0x403b89
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov eax, dword [ebp - 0x38]
jmp 0x403c4b
push edi
call dword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d4d
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x403d86
push 0xf01ff
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x403d8a
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x403dae
lea eax, [ebp - 0x1c]
push ebx
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
xor eax, eax
test ebx, ebx
setne al
pop ebx
pop edi
pop esi
leave
ret
Function at 0x403dc7
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x620
mov eax, dword [ebp + 0xc]
push ebx
xor ebx, ebx
push esi
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
cmp eax, ebx
push edi
je 0x403de3
mov byte [eax], bl
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x403dec
mov byte [eax], bl
push dword [ebp + 8]
lea eax, [ebp - 0x220]
push eax
call fcn.00404900
lea eax, [ebp - 0x220]
push 0x5c
push eax
call fcn.00404454
add esp, 0x10
lea eax, [ebp - 0x220]
push ebx
push ebx
push 3
push ebx
push 3
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x403f92
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x61f]
mov byte [ebp - 0x620], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp + 8]
mov eax, 0x400
push ebx
push ecx
mov dword [ebp - 0x61c], eax
push eax
lea eax, [ebp - 0x620]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp - 0xc]
push 0xc
push eax
push 0x2d1400
push esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x403f92
mov eax, dword [ebp - 0x614]
mov byte [ebp - 0x11c], bl
cmp eax, ebx
je 0x403ebd
lea eax, [ebp + eax - 0x620]
push 0x40
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00404ab0
lea eax, [ebp - 0x11c]
push eax
call fcn.004044fc
add esp, 0x10
mov eax, dword [ebp - 0x610]
cmp eax, ebx
je 0x403f17
cmp dword [ebp - 0x614], ebx
je 0x403ef2
cmp byte [ebp + eax - 0x620], 0x20
je 0x403ef2
lea eax, [ebp - 0x11c]
push 0x40d798
push eax
call fcn.00404910
mov eax, dword [ebp - 0x610]
pop ecx
pop ecx
lea eax, [ebp + eax - 0x620]
push 0x40
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00405a60
lea eax, [ebp - 0x11c]
push eax
call fcn.00404490
add esp, 0x10
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp - 0x604]
cmp esi, ebx
mov dword [edi], eax
je 0x403f41
lea eax, [ebp - 0x11c]
push 0x80
push eax
push esi
call fcn.00404ab0
add esp, 0xc
mov byte [esi + 0x7f], bl
mov esi, dword [ebp + 0x10]
cmp esi, ebx
je 0x403f8e
lea eax, [ebp - 0x11c]
push 0x70
push eax
push esi
call fcn.00404ab0
lea eax, [ebp - 0x1c]
mov byte [esi + 0x6f], bl
push eax
push edi
call fcn.00403f99
add esp, 0x14
test al, al
je 0x403f8e
push 0x40d798
push esi
call fcn.00404910
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.00404910
push str._Device
push esi
call fcn.00404910
add esp, 0x18
mov al, 1
jmp 0x403f94
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4040fc
Capabilities:
Get disk information via ioctl

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x110]
push eax
call fcn.00404900
lea eax, [ebp - 0x110]
push 0x5c
push eax
call fcn.00404454
add esp, 0x10
xor esi, esi
lea eax, [ebp - 0x110]
push esi
push esi
push 3
push esi
push 3
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404175
push ebx
lea eax, [ebp + 8]
push esi
push eax
lea eax, [ebp - 0xc]
push 0xc
push eax
push esi
push esi
push 0x2d1080
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, esi
pop ebx
je 0x404175
mov eax, dword [ebp - 8]
jmp 0x404178
or eax, 0xffffffff
pop edi
pop esi
leave
ret

Function at 0x404212
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push ebx
push esi
mov ebx, str._Volume
push edi
push ebx
push dword [ebp + 8]
call fcn.00404a30
mov esi, dword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
mov edi, dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointA]
pop ecx
test eax, eax
pop ecx
je 0x40424e
push dword [ebp + 8]
lea eax, [ebp - 0x5c]
push eax
call fcn.00404900
pop ecx
pop ecx
jmp 0x40426b
lea eax, [ebp - 0x114]
push 0x34
push eax
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x5c]
push 0x34
push eax
lea eax, [ebp - 0x114]
push eax
call edi
push ebx
push dword [ebp + 0xc]
call fcn.00404a30
pop ecx
test eax, eax
pop ecx
je 0x40428d
push dword [ebp + 8]
lea eax, [ebp - 0xb8]
push eax
call fcn.00404900
pop ecx
pop ecx
jmp 0x4042ad
lea eax, [ebp - 0x170]
push 0x34
push eax
push dword [ebp + 0xc]
call esi
lea eax, [ebp - 0xb8]
push 0x34
push eax
lea eax, [ebp - 0x170]
push eax
call edi
lea eax, [ebp - 0x5c]
push 0x5c
push eax
call fcn.00404471
lea eax, [ebp - 0xb8]
push 0x5c
push eax
call fcn.00404471
mov esi, dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
add esp, 0x10
lea eax, [ebp - 0xb8]
push eax
call esi
mov edi, eax
lea eax, [ebp - 0x5c]
push eax
call esi
cmp eax, edi
je 0x4042e8
xor al, al
jmp 0x404306
lea eax, [ebp - 0xb8]
push eax
call fcn.004040fc
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
call fcn.004040fc
pop ecx
cmp eax, esi
pop ecx
sete al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404338
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push ebx
push esi
push edi
push 0x26
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0x9c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x98]
mov esi, dword [ebp - 0x94]
mov dword [eax + 0x14], edx
mov edx, ecx
shl edx, 8
add edx, esi
cmp dword [ebp - 0x8c], 2
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], esi
sete bl
test bl, bl
mov dword [eax + 0x18], edx
mov byte [eax], bl
je 0x4043e2
cmp ecx, 4
sete dl
cmp ecx, 5
mov byte [eax + 1], dl
jne 0x4043b7
test esi, esi
jne 0x4043b7
push 1
pop edx
jmp 0x4043b9
xor edx, edx
cmp ecx, 5
mov byte [eax + 2], dl
jne 0x4043c8
push 1
pop edx
cmp esi, edx
jge 0x4043ca
xor edx, edx
cmp ecx, 6
mov byte [eax + 3], dl
jne 0x4043db
test esi, esi
jne 0x4043db
push 1
pop edx
jmp 0x4043dd
xor edx, edx
mov byte [eax + 4], dl
jmp 0x404400
test esi, esi
sete dl
cmp esi, 1
mov byte [eax + 6], dl
sete dl
cmp esi, 0x5a
mov byte [eax + 7], dl
setge dl
mov byte [eax + 5], 1
mov byte [eax + 8], dl
cmp ecx, 5
jge 0x404417
test bl, bl
jne 0x404413
cmp ecx, 4
jl 0x404413
cmp esi, 1
jge 0x404417
xor ecx, ecx
jmp 0x40441a
push 1
pop ecx
pop edi
pop esi
mov byte [eax + 0x1c], cl
pop ebx
leave
ret
Function at 0x404727
Capabilities:
Create process on windows
Create process suspended
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x868
push ebx
push esi
lea eax, [ebp - 0x868]
push edi
push eax
lea eax, [ebp - 0x364]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x40e6b0]
add eax, 0x104
push eax
call fcn.004053cd
add esp, 0x14
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x264]
push str._s_s
push eax
call fcn.00404bae
add esp, 0x10
lea eax, [ebp - 0x364]
push str..bat
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x160]
push str._sdel__s_s
push eax
call fcn.00404bae
add esp, 0x14
xor esi, esi
lea eax, [ebp - 0x160]
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov eax, dword [0x40e6b0]
lea ecx, [ebp - 0x160]
add eax, 0x104
push ecx
push eax
push eax
lea eax, [ebp - 0x768]
push str._echo_off_r_n:Repeat_r_ndel___s___NUL_1_NUL_2_NUL_r_nif_exist___s__goto_Repeat_r_ndel___s___NUL_1_NUL_2_NUL_r_n
push eax
call fcn.00404bae
add esp, 0x14
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push esi
push eax
lea eax, [ebp - 0x768]
push eax
call fcn.00405120
pop ecx
push eax
lea eax, [ebp - 0x768]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x18], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x160]
mov dword [ebp - 0x5c], 0x44
push eax
lea eax, [ebp - 0x568]
push 0x40d6c4
push eax
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], si
call fcn.00404bae
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x264]
push eax
push esi
push 0x40
push esi
push esi
lea eax, [ebp - 0x568]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x14]
call ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4071ec
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push 4
pop eax
call fcn.00405390
mov ebx, esp
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x407281
mov edi, dword [ebp - 0x20]
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x44]
lea esi, [eax - 1]
not esi
and esi, ebx
sub esi, eax
mov dword [ebp - 4], eax
mov eax, dword [0x40eb5c]
mov ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
and ecx, 0xffff1000
add ecx, 0x11000
add ecx, edi
cmp esi, ecx
jb 0x407281
cmp eax, 1
je 0x407299
mov ebx, edi
mov edi, 0x1000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x407281
add ebx, dword [ebp - 0x18]
test dword [ebp - 0x14], edi
je 0x407256
test byte [ebp - 0xf], 1
mov ebx, dword [ebp - 0x24]
je 0x40727d
xor eax, eax
inc eax
jmp 0x4072b5
cmp esi, ebx
jae 0x407285
xor eax, eax
jmp 0x4072b5
push 4
push edi
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x40eb5c]
jmp 0x40729b
mov ebx, esi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 8]
push ecx
inc eax
push eax
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x408749
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov edx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
cmp edx, dword [eax*8 + 0x40dfe0]
je 0x408769
inc eax
cmp eax, 0x12
jb 0x40875a
shl eax, 3
cmp edx, dword [eax + 0x40dfe0]
mov dword [ebp + 8], eax
jne 0x408907
mov ecx, dword [0x40eafc]
cmp ecx, 1
je 0x4088dc
test ecx, ecx
jne 0x40879b
cmp dword [0x40dc14], 1
je 0x4088dc
cmp edx, 0xfc
je 0x408907
and byte [ebp - 8], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087d6
push 5
pop ecx
mov esi, str._program_name_unknown_
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x10c]
lea ebx, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4087e5
sub eax, edx
inc eax
cmp eax, 0x3c
jbe 0x40881d
lea eax, [ebp - 0x10c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4087fd
sub eax, edx
push 3
lea ebx, [ebp + eax - 0x147]
push 0x40bba8
push ebx
call fcn.00404ab0
add esp, 0xc
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408822
sub eax, edx
mov ecx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x40dfe4]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x408839
sub eax, esi
lea eax, [eax + ecx + 0x1c]
add eax, 3
and eax, 0xfffffffc
call fcn.00405390
mov edx, esp
push 6
pop ecx
mov esi, str.Runtime_Error__n_nProgram:
mov edi, edx
rep movsd dword es:[edi], dword [esi]
mov eax, ebx
movsw word es:[edi], word [esi]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408865
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x408871
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40888a
mov eax, dword [ebp + 8]
mov esi, 0x40bb88
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov eax, dword [eax + 0x40dfe4]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4088a5
mov edi, edx
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4088b1
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x12010
mov ecx, eax
and ecx, 3
push str.Microsoft_Visual_C_Runtime_Library
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00409e2e
add esp, 0xc
jmp 0x408907
mov ecx, dword [eax + 0x40dfe4]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4088e7
push 0
lea edx, [ebp - 4]
push edx
sub eax, esi
push eax
push ecx
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x118]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409399
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov ecx, dword [ebp + 8]
cmp ecx, dword [0x40ece4]
push ebx
push esi
push edi
jae 0x40951e
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x40ed00]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x14], ebx
je 0x40951e
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
jne 0x4093ed
xor eax, eax
jmp 0x409532
test al, 0x20
je 0x4093fe
push 2
push edi
push edi
push ecx
call fcn.0040a0f2
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x4094ba
cmp dword [ebp + 0x10], edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp + 8], edi
jbe 0x4094f2
mov ecx, dword [ebp - 4]
sub ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x418]
cmp ecx, dword [ebp + 0x10]
jae 0x409454
mov edx, dword [ebp - 4]
inc dword [ebp - 4]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x409445
inc dword [ebp - 0x10]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x14]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x40942a
mov edi, eax
lea eax, [ebp - 0x418]
sub edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push edi
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409494
mov eax, dword [ebp - 0xc]
add dword [ebp - 8], eax
cmp eax, edi
jl 0x40949d
mov eax, dword [ebp - 4]
sub eax, dword [ebp + 0xc]
xor edi, edi
cmp eax, dword [ebp + 0x10]
jb 0x40941e
jmp 0x40949f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
xor edi, edi
mov eax, dword [ebp - 8]
cmp eax, edi
jne 0x409519
cmp dword [ebp + 8], edi
je 0x4094f2
push 5
pop eax
cmp dword [ebp + 8], eax
jne 0x4094e7
mov dword [0x40eb54], eax
jmp 0x409525
push edi
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4094dc
mov eax, dword [ebp - 0xc]
mov dword [ebp + 8], edi
mov dword [ebp - 8], eax
jmp 0x40949f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 8], eax
jmp 0x40949f
push dword [ebp + 8]
call fcn.00409fdd
pop ecx
jmp 0x40952f
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x409507
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0x1a
je 0x4093e6
mov dword [0x40eb50], 0x1c
mov dword [0x40eb54], edi
jmp 0x40952f
sub eax, dword [ebp - 0x10]
jmp 0x409532
and dword [0x40eb54], 0
mov dword [0x40eb50], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret