joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1374
call fcn.004018c0
mov eax, dword [esp + 0x1378]
push esi
lea ecx, [esp + 0x5c]
push edi
push ecx
mov dword [0x406550], eax
call fcn.00401300
add esp, 4
test eax, eax
je 0x40117a
lea edx, [esp + 0x70]
lea eax, [esp + 0x37c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x37c]
push str.shfill.exe_form.ftf__
push ecx
call esi
lea edx, [esp + 0x278]
lea eax, [esp + 0x37c]
push edx
push eax
call esi
lea ecx, [esp + 0x37c]
push 0x40604c
push ecx
call esi
mov eax, dword [esp + 0x60]
test eax, eax
je 0x40108d
lea edx, [esp + 0x37c]
push str._Form.fdd
push edx
call esi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x1c]
lea edx, [esp + 0x70]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x398]
push 0
push eax
push 0
mov dword [esp + 0x44], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401134
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebx, 0x103
push 0xffffffffffffffff
push ecx
mov dword [esp + 0x18], ebx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [esp + 0x18]
push edx
call ebp
push 0xffffffffffffffff
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esp + 0x10], ebx
jne 0x401129
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push edx
call esi
push 0x14
call edi
cmp dword [esp + 0x10], ebx
je 0x401113
mov eax, dword [esp + 0x14]
push eax
call ebp
pop ebp
pop ebx
jmp 0x40117a
push 0
lea ecx, [esp + 0xc]
push 0
push ecx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0
push 0x1100
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push 0x10
push str.System_Error
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x60]
push ecx
call fcn.004011a0
add esp, 4
xor eax, eax
pop edi
pop esi
add esp, 0x1374
ret 0x10
Function at 0x4011a0
Capabilities:
Delete directory

Disassembly:
sub esp, 0x104
push ebx
mov ebx, dword [esp + 0x10c]
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4012b7
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ebp, [ebx + 0x10]
push edi
lea eax, [esp + 0x10]
push ebp
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [esp + eax + 0x10]
push str.ShFill.exe
push edi
call esi
lea edx, [esp + 0x10]
push edx
call fcn.004012c0
add esp, 4
push str.ShFill._xe
push edi
call esi
lea eax, [esp + 0x10]
push eax
call fcn.004012c0
add esp, 4
push str.Form.ftf
push edi
call esi
lea ecx, [esp + 0x10]
push ecx
call fcn.004012c0
mov eax, dword [ebx + 8]
add esp, 4
test eax, eax
je 0x40124c
push str.codebar.dll
push edi
call esi
lea edx, [esp + 0x10]
push edx
call fcn.004012c0
add esp, 4
push str.codebar._dl
push edi
call esi
lea eax, [esp + 0x10]
push eax
call fcn.004012c0
add esp, 4
mov eax, dword [ebx + 4]
test eax, eax
je 0x40127d
push str.vtssdl32.dll
push edi
call esi
lea ecx, [esp + 0x10]
push ecx
call fcn.004012c0
add esp, 4
push str.vtssdl32._dl
push edi
call esi
lea edx, [esp + 0x10]
push edx
call fcn.004012c0
add esp, 4
cmp dword [ebx], 0
je 0x401297
push str.Form.fdd
push edi
call esi
lea eax, [esp + 0x10]
push eax
call fcn.004012c0
add esp, 4
lea ecx, [ebx + 0x114]
push ecx
call fcn.004012c0
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
mov dword [ebx + 0xc], 1
pop ebp
pop ebx
add esp, 0x104
ret

Function at 0x4012c0
Capabilities:
Delete file

Disassembly:
sub esp, 0x88
lea eax, [esp]
push esi
mov esi, dword [esp + 0x90]
push 0x4000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_OpenFile]
cmp eax, 0xffffffff
je 0x4012eb
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
add esp, 0x88
ret
Function at 0x4016b0
Capabilities:
Copy file

Disassembly:
mov ecx, dword [esp + 8]
sub esp, 0x110
lea eax, [esp]
push edi
push 0
push eax
push ecx
call sub.LZ32.dll_LZOpenFileA
mov edi, eax
test edi, edi
jge 0x4016d8
xor eax, eax
pop edi
add esp, 0x110
ret
mov eax, dword [esp + 0x118]
push ebx
push esi
lea edx, [esp + 0x94]
push 0x1000
push edx
push eax
call sub.LZ32.dll_LZOpenFileA
mov esi, eax
push esi
push edi
call sub.LZ32.dll_LZCopy
push edi
mov ebx, eax
call sub.LZ32.dll_LZClose
push esi
call sub.LZ32.dll_LZClose
xor eax, eax
pop esi
test ebx, ebx
pop ebx
pop edi
setge al
add esp, 0x110
ret

Function at 0x401720
Capabilities:
Create directory
Delete file
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push esi
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [esp + 0x10c]
lea ecx, [esp + 4]
push esi
push 0
push 0x4060d4
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x401777
push edi
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x4060d0
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, edi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x401780
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x104
lea esi, [edi + 0x114]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [eax + edi + 0x113]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
dec eax
cmp cl, 0x5c
je 0x4017ba
push 0x4060d0
push esi
call edi
push str.ShFill
push esi
call edi
push str..ini
push esi
call edi
pop edi
pop esi
ret

Function at 0x4017d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x100c
call fcn.004018c0
mov eax, dword [esp + 0x101c]
push ebx
push 0
push 0x10000000
push 1
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [esp + 0x1014]
mov dword [esp + 4], eax
test ebx, ebx
jne 0x401814
xor eax, eax
pop ebx
add esp, 0x100c
ret
mov ecx, dword [esp + 0x1018]
push edi
push 0
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x1020]
test edi, edi
jbe 0x401880
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
cmp edi, 0x1000
mov esi, 0x1000
ja 0x40184a
mov esi, edi
lea edx, [esp + 0x14]
push 0
push edx
lea eax, [esp + 0x24]
push esi
push eax
push ebx
call ebp
test eax, eax
je 0x40187a
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push 0
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x24]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub edi, esi
jne 0x40183b
pop esi
pop ebp
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop ebx
add esp, 0x100c
ret
Function at 0x402535
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4061a0
cmp edx, dword [eax]
je 0x402557
add eax, 8
inc ecx
cmp eax, 0x406230
jl 0x402548
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4061a0]
jne 0x402685
mov eax, dword [0x40655c]
cmp eax, 1
je 0x40265f
test eax, eax
jne 0x402588
cmp dword [0x4060f4], 1
je 0x40265f
cmp edx, 0xfc
je 0x402685
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4025bf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402ae0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402c50
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x402602
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402c50
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4053e8
push edi
call fcn.004038e0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402ae0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402af0
lea eax, [ebp - 0xa0]
push 0x4053c8
push eax
call fcn.00402af0
push dword [esi + 0x4061a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402af0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040384e
add esp, 0x2c
pop edi
jmp 0x402685
lea eax, [ebp + 8]
lea esi, [esi + 0x4061a4]
push 0
push eax
push dword [esi]
call fcn.00402c50
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x53b97987
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2d242cd3
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4024e1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x3c], eax
push 8
pop ecx
xor eax, eax
mov byte [ebp - 0x2c], bl
lea edi, [ebp - 0x2b]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
stosb byte es:[edi], al
call fcn.00476b3a
test eax, eax
jne 0x402668
cmp esi, ebx
je 0x40252e
mov dword [esi], ebx
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x402537
mov dword [eax], ebx
push dword [ebp - 0x34]
mov esi, 0x4c93bc
call fcn.00476ca7
test eax, eax
pop ecx
jne 0x40256d
mov esi, dword [ebp - 0x34]
push str..exe
mov dword [ebp - 0x44], 0x4e20
call fcn.004773ce
push eax
call fcn.004ab3bf
test eax, eax
pop ecx
pop ecx
je 0x402570
xor edi, edi
jmp 0x40257a
mov dword [ebp - 0x44], ebx
mov ecx, dword [ebp - 0x34]
call fcn.00402d7b
mov edi, eax
push dword [ebp - 0x44]
mov eax, dword [ebp - 0x34]
push 0x80000020
push 3
push 1
call fcn.00418dab
mov esi, eax
add esp, 0x10
cmp esi, 0xffffffff
jne 0x4025a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402668
push ebx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x38]
push eax
push esi
call edi
test eax, eax
je 0x402658
cmp dword [ebp - 0x30], 4
jb 0x402658
push ebx
lea eax, [ebp - 0x30]
push eax
push 4
lea eax, [ebp - 0x40]
push eax
push esi
call edi
test eax, eax
je 0x40260b
cmp dword [ebp - 0x30], 4
jb 0x40260b
push ebx
lea eax, [ebp - 0x30]
push eax
push 8
lea eax, [ebp - 0x48]
push eax
push esi
call edi
push ebx
lea eax, [ebp - 0x30]
push eax
push 0x20
lea eax, [ebp - 0x2c]
push eax
push esi
call edi
test eax, eax
jne 0x402612
call fcn.0041cef3
jmp 0x402668
call fcn.0041cef3
mov eax, dword [ebp - 0x30]
cmp eax, 0x22
jae 0x402668
mov byte [ebp + eax - 0x2c], bl
lea eax, [ebp - 0x2c]
push str.222PAULAARCHIVE222JesusIAdoreYou
push eax
call fcn.004abab0
test eax, eax
pop ecx
pop ecx
jne 0x402668
mov ecx, dword [ebp - 0x38]
cmp ecx, ebx
je 0x402668
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
je 0x40264a
mov edx, dword [ebp - 0x40]
mov dword [eax], edx
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
je 0x402653
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x40266a
call fcn.0041cef3
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x34]
call fcn.0041abf9
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
leave
ret
Function at 0x402e2e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x4d
lea eax, [ebp - 0x53]
push ebx
push eax
mov byte [ebp - 0x54], bl
call fcn.004ab5d0
add esp, 0xc
cmp esi, ebx
jne 0x402e5f
or eax, 0xffffffff
jmp 0x402f0a
lea eax, [ebp - 0x54]
push eax
mov edx, str.____This_is_the_beginning_of_a_PAULA_Arkive_self_extracting_compilation.____
call fcn.0047900f
push esi
call fcn.004aad22
push esi
mov dword [ebp - 0x58], ebx
call fcn.004aad7e
add esp, 0xc
cmp eax, 0xffffffff
je 0x402ea6
push 1
push eax
lea eax, [ebp - 0x58]
lea ebx, [ebp - 0x54]
call fcn.00420e65
test eax, eax
pop ecx
pop ecx
jne 0x402f03
push esi
call fcn.004aad7e
cmp eax, 0xffffffff
pop ecx
jne 0x402e84
xor ebx, ebx
push edi
push 2
push ebx
push esi
call fcn.004aab1f
add esp, 0xc
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004aa880
pop ecx
push eax
lea eax, [ebp - 0x54]
push 1
push eax
call fcn.004aa5f2
mov edi, eax
lea eax, [ebp - 0x54]
push eax
call fcn.004aa880
add esp, 0x14
cmp edi, eax
pop edi
jne 0x402e57
push esi
call fcn.004aad22
push 2
push 0xffffffffffffffff
push esi
call fcn.004aab1f
push esi
call fcn.004aad7e
push 2
push ebx
push esi
call fcn.004aab1f
add esp, 0x20
push esi
call fcn.004aa80c
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004aaeb5
leave
ret
Function at 0x403d68
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004bc5d0
push ebx
push esi
xor ebx, ebx
push 0xffc
lea eax, [ebp - 0x1004]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x1008], ebx
call fcn.004ab5d0
add esp, 0xc
cmp dword [ebp + 8], ebx
mov dword [ebp - 8], ebx
jne 0x403da5
xor eax, eax
jmp 0x403e2e
shr esi, 2
mov eax, 0x40000
cmp esi, eax
mov dword [ebp - 4], esi
jbe 0x403db7
mov dword [ebp - 4], eax
shr dword [ebp - 4], 2
push edi
mov edi, 0x400
cmp dword [ebp - 4], edi
jbe 0x403dd8
push 4
push dword [ebp - 4]
call fcn.004aa454
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
jne 0x403de1
mov dword [ebp - 4], edi
lea esi, [ebp - 0x1008]
xor edi, edi
push dword [ebp + 8]
push dword [ebp - 4]
push 4
push esi
call fcn.004ab915
add esp, 0x10
test eax, eax
mov dword [ebp - 8], eax
jbe 0x403e0d
xor ebx, ebx
test eax, eax
jbe 0x403e09
add edi, dword [esi + ebx*4]
inc ebx
cmp ebx, eax
jb 0x403e01
add edi, eax
jmp 0x403de3
test edi, edi
jne 0x403e16
test ebx, ebx
je 0x403e16
inc edi
test esi, esi
je 0x403e2b
lea eax, [ebp - 0x1008]
cmp esi, eax
je 0x403e2b
push esi
call fcn.004aa2a8
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a8af
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp + 0x84], eax
push ebx
push esi
push edi
push 0x103
lea eax, [ebp - 0x7f]
push 0
push eax
mov byte [ebp - 0x80], 0
call fcn.004ab5d0
add esp, 0xc
call fcn.0040a850
xor edi, edi
inc edi
call fcn.0040c62d
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
jne 0x40a8fd
xor edi, edi
mov esi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
push 7
push 0xfffffffffffffff6
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push eax
call ebx
test eax, eax
jne 0x40a918
xor edi, edi
push 3
push 0xfffffffffffffff5
call esi
push eax
call ebx
test eax, eax
jne 0x40a927
xor edi, edi
push 1
push 0x40aa18
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x40a93a
xor edi, edi
push 0x35c
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
test eax, eax
jne 0x40a94b
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor ebx, ebx
cmp eax, ebx
mov dword [0x519860], eax
jne 0x40a95e
xor edi, edi
lea eax, [ebp - 0x80]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jbe 0x40a99b
lea edx, [ebp - 0x80]
call fcn.00477617
mov eax, edx
push eax
mov esi, 0x4c93bc
call fcn.00476ca7
test eax, eax
pop ecx
jne 0x40a99b
push ebx
push ebx
call fcn.0045aa3a
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.Sounds_
push ebx
call fcn.0045aa3a
pop ecx
pop ecx
mov ebx, eax
call fcn.00474031
call fcn.0049c471
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004aba7f
pop ecx
call fcn.004aba8c
call fcn.004aba8c
call fcn.004aba8c
mov ecx, dword [ebp + 0x84]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
add ebp, 0x88
leave
ret
Function at 0x40aa7c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor ebx, ebx
push ebx
mov esi, eax
call fcn.0040ac23
cmp esi, ebx
pop ecx
mov dword [0x519790], ebx
jne 0x40aabb
xor eax, eax
jmp 0x40ac0c
push edi
push 0x400
mov eax, 0x519390
push ebx
push eax
mov dword [0x519798], eax
xor edi, edi
mov dword [ebp - 0x7c], ebx
call fcn.004ab5d0
mov eax, dword [0x519790]
mov edx, dword [0x51938c]
add esp, 0xc
cmp byte [esi], bl
je 0x40ab84
mov dword [ebp - 0x80], esi
cmp eax, 0x32
jge 0x40ab70
lea esi, [edx + edi]
cmp esi, 0x3f6
jge 0x40ab70
mov ecx, dword [ebp - 0x80]
mov cl, byte [ecx]
cmp cl, 0x20
ja 0x40ab43
xor ebx, ebx
cmp dword [ebp - 0x7c], ebx
jne 0x40ab43
cmp edi, ebx
jle 0x40ab3f
inc eax
cmp eax, 1
lea edx, [esi + 6]
mov dword [0x519790], eax
mov dword [0x51938c], edx
jne 0x40ab32
add edx, 4
mov dword [0x51938c], edx
lea ecx, [edx + 0x519390]
mov dword [eax*4 + 0x519798], ecx
xor edi, edi
jmp 0x40ab66
cmp cl, 0x22
jne 0x40ab5b
cmp dword [ebp - 0x7c], ebx
jne 0x40ab56
mov dword [ebp - 0x7c], 1
jmp 0x40ab66
mov dword [ebp - 0x7c], ebx
jmp 0x40ab66
mov esi, dword [eax*4 + 0x519798]
mov byte [edi + esi], cl
inc edi
inc dword [ebp - 0x80]
mov ecx, dword [ebp - 0x80]
cmp byte [ecx], bl
jne 0x40aaf0
cmp edi, ebx
jle 0x40ab84
inc eax
lea edx, [edx + edi + 1]
mov dword [0x519790], eax
mov dword [0x51938c], edx
push 0x32
pop ecx
cmp eax, ecx
jge 0x40ab9c
lea edi, [eax*4 + 0x519798]
sub ecx, eax
lea eax, [edx + 0x519390]
rep stosd dword es:[edi], eax
mov esi, dword [0x519798]
call fcn.004773ce
mov edx, eax
call fcn.00476b3a
test eax, eax
je 0x40ac06
push 0x103
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call fcn.004ab5d0
push dword [0x519798]
mov esi, 0x104
mov ecx, esi
lea eax, [ebp - 0x78]
call fcn.00476b6c
mov eax, esi
push str..exe
lea esi, [ebp - 0x78]
call fcn.00476c3c
add esp, 0x14
mov edi, esi
call fcn.0041a629
test eax, eax
je 0x40ac06
mov eax, esi
push eax
push dword [0x519798]
call fcn.004aa9a0
pop ecx
pop ecx
mov eax, dword [0x519790]
pop edi
mov ecx, dword [ebp + 0x8c]
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
add ebp, 0x90
leave
ret
Function at 0x40acfc
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
lea ebp, [esp - 0x79c]
sub esp, 0x81c
mov eax, dword [0x5065d0]
xor eax, ebp
mov dword [ebp + 0x798], eax
mov eax, dword [ebp + 0x7a4]
push ebx
push esi
push edi
xor ebx, ebx
push 0x7fe
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x66]
push ebx
push eax
mov word [ebp - 0x68], bx
call fcn.004ab5d0
xor eax, eax
xor ecx, ecx
add esp, 0xc
cmp byte [ebp + 0x7b0], bl
lea edi, [ebp - 0x72]
setne cl
stosw word es:[edi], ax
mov edi, dword [ebp + 0x7a8]
mov eax, 0x400
mov dword [ebp - 0x6c], ebx
sub eax, ecx
cmp edi, eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x7c], ebx
jl 0x40ad70
mov eax, 0x3ff
sub eax, ecx
mov edi, eax
call fcn.0040c5e9
lea ebx, [ebp - 0x70]
lea esi, [ebp - 0x6c]
mov dword [ebp - 0x80], eax
call fcn.0040c241
cmp byte [ebp + 0x7b0], 0
mov ax, word [ebp - 0x6c]
mov word [ebp - 0x74], ax
mov ax, word [ebp - 0x70]
mov word [ebp - 0x72], ax
je 0x40ad9d
inc edi
test edi, edi
jle 0x40aeb0
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x68]
push edi
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
test eax, eax
je 0x40aee1
mov eax, dword [ebp - 0x7c]
test eax, eax
je 0x40aee1
cmp eax, edi
je 0x40add3
mov edi, eax
xor eax, eax
cmp dword [ebp + 0x7ac], eax
je 0x40adee
test edi, edi
jle 0x40adfe
or word [ebp + eax*2 - 0x68], 8
inc eax
cmp eax, edi
jl 0x40ade1
jmp 0x40adfe
test edi, edi
jle 0x40adfe
and word [ebp + eax*2 - 0x68], 0xfff7
inc eax
cmp eax, edi
jl 0x40adf2
cmp byte [ebp + 0x7b0], 0
je 0x40ae10
lea eax, [ebp + eax*2 - 0x6a]
and word [eax], 0xfff7
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x68]
push edi
push eax
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputAttribute]
mov esi, dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x74]
xor eax, eax
cmp byte [ebp + 0x7b0], al
mov ecx, edi
setne al
sub ecx, eax
push ecx
push dword [ebp - 0x78]
push dword [ebp - 0x80]
call esi
call fcn.0040c567
and dword [ebp - 0x78], 0
test edi, edi
mov ebx, eax
jle 0x40aeb0
cmp byte [ebp + 0x7b0], 0
je 0x40ae8f
lea eax, [edi - 1]
cmp dword [ebp - 0x78], eax
jne 0x40ae8f
mov ax, word [ebp - 0x6c]
mov word [ebp - 0x74], ax
mov ax, word [ebp - 0x70]
mov word [ebp - 0x72], ax
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp + 0x7b0]
push 1
push eax
push dword [ebp - 0x80]
call esi
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], ebx
jl 0x40aea8
call fcn.0040c476
and dword [ebp - 0x6c], 0
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], eax
jge 0x40aed7
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], edi
jl 0x40ae59
push dword [ebp - 0x70]
push dword [ebp - 0x6c]
call fcn.0040c199
pop ecx
pop ecx
mov eax, edi
mov ecx, dword [ebp + 0x798]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aaeb5
add ebp, 0x79c
leave
ret
dec eax
dec ebx
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], ebx
jmp 0x40aeb0
or eax, 0xffffffff
jmp 0x40aebf